What is the CVSS score of CVE-2026-3504?

CVE-2026-3504 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Dokan WordPress Plugin CVE-2026-3504

EUVD-2026-26790 MEDIUM

Information Exposure (CWE-200)

2026-05-02 Wordfence

WordPress Information Disclosure

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 14:00 vuln.today

EUVD ID Assigned

May 02, 2026 - 13:30 euvd

EUVD-2026-26790

Analysis Generated

May 02, 2026 - 13:30 vuln.today

CVE Published

May 02, 2026 - 13:26 nvd

MEDIUM 5.3

DescriptionCVE.org

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.1 via the '/dokan/v1/stores/{id}/reviews' REST API endpoint. This is due to the 'prepare_reviews_for_response' method including reviewer email addresses, usernames, and user IDs in the API response. This makes it possible for unauthenticated attackers to extract email addresses, usernames, and user IDs of all customers who left reviews on any vendor's store. The Pro version of the plugin must be installed and activated, with store reviews enabled, in order to exploit the vulnerability.

AnalysisAI

Unauthenticated remote attackers can extract sensitive user information including email addresses, usernames, and user IDs through the '/dokan/v1/stores/{id}/reviews' REST API endpoint in Dokan plugin versions up to 4.3.1. The vulnerability affects only installations with the Pro version activated and store reviews enabled, allowing information disclosure of all customers who left vendor reviews. No public exploit code has been identified, but the attack requires no authentication or user interaction and can be automated at scale.

Technical ContextAI

The Dokan plugin's REST API StoreController contains a 'prepare_reviews_for_response' method that serializes customer review data without filtering sensitive fields. The endpoint '/dokan/v1/stores/{id}/reviews' exposes reviewer PII (email, username, user ID) via the HTTP response body. This is a failure to implement proper output filtering at the API serialization layer (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability exists in the Pro version when store reviews feature is enabled, affecting the REST API controller's data preparation logic documented in the plugin's source code at StoreController.php lines 125, 835, and 854.

RemediationAI

Update the Dokan plugin to version 4.3.2 or later, which the vendor released as a patched version (confirmed by changeset 3481799 on plugins.trac.wordpress.org). The patch modifies the 'prepare_reviews_for_response' method in StoreController.php to filter email addresses, usernames, and user IDs from REST API responses. For sites unable to immediately upgrade, disable the store reviews feature in Dokan Pro settings to block access to the vulnerable endpoint, though this disables customer review functionality. Alternatively, use a Web Application Firewall rule to deny unauthenticated requests to '/dokan/v1/stores/*/reviews' endpoints (trade-off: review API access unavailable for all clients). Verify upgrade completion by checking the plugin version in WordPress admin and testing that /dokan/v1/stores/{id}/reviews responses no longer include reviewer emails or IDs. References: https://www.wordfence.com/threat-intel/vulnerabilities/id/02b0d7d7-8a10-48de-b1e1-7e1f1fda6ffe?source=cve and https://plugins.trac.wordpress.org/changeset/3481799/