What is the CVSS score of CVE-2026-49780?

CVE-2026-49780 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-49780?

Within 24 hours: Identify all WordPress instances running Dokan versions 5.0.2 or earlier; assess which customer accounts have suspicious privilege levels; restrict API and database access to administrative functions. Within 7 days: Disable customer privilege-elevation features in Dokan settings if available; implement strict role-based access controls; activate comprehensive logging on account and permission changes. Within 30 days: Obtain explicit confirmation from Dokan vendors on patch timeline; if no patch is forthcoming, evaluate migration to alternative marketplace platforms; execute forensic audit of all customer account privilege escalations since deployment.

Dokan CVE-2026-49780

EUVD-2026-36897 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-06-15 Patchstack

GHSA-9grp-3x37-pqm5

WordPress Privilege Escalation Dokan Wordpress Plugin Dokan Inc

8.8

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Identify Dokan-powered marketplace ≤5.0.2
Delivery

Register customer account via public signup
Exploit

Authenticate to WordPress front-end
Install

Send crafted request abusing role/capability assignment
C2

Receive elevated vendor or admin privileges
Execute

Access PII, orders, or install malicious plugin
Impact

Full marketplace compromise

Vulnerability Assessment

Weakness	CWE CWE-266 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Privilege assignment review
Exploitation Conditions	Exploitation requires (1) a reachable Dokan-powered WordPress site running plugin version 5.0.2 or earlier, and (2) an authenticated session as a low-privileged customer account, which on most Dokan marketplaces is obtainable simply by completing the public customer-registration flow (consistent with CVSS PR:L and UI:N). No additional user interaction, victim-side action, or non-default plugin configuration is indicated by the available data; the practical limit on exploitation is that customer registration must be enabled (the default for a functioning storefront) and the attacker must be able to reach the WordPress front-end over the network.
Impact	The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is consistent with a network-reachable, low-complexity action by an authenticated low-privileged user yielding full CIA impact within the WordPress site - appropriate given that customer self-registration is enabled on most Dokan-powered storefronts, effectively lowering the bar to 'anyone who can sign up.' No EPSS score, KEV listing, SSVC decision, or public POC was supplied with this CVE, so widespread automated exploitation cannot be confirmed; however, the combination of an easy-to-obtain prerequisite (customer account) and high impact makes this a real priority for any marketplace operator rather than a theoretical high-CVSS issue. Defenders should treat this as urgent because Dokan installations typically expose registration and rely on role separation as their primary security boundary.
Exploit ScenarioDerived	An attacker registers a normal customer account on a Dokan-powered marketplace, then sends a crafted authenticated request to a Dokan endpoint that fails to properly validate the requested role or capability, causing the backend to grant the account vendor or administrator-level privileges. From there the attacker can list/edit products, view other customers' orders and PII, install malicious plugins, or pivot to full site takeover; no public POC has been identified at time of analysis but the CWE-266 pattern is well understood.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 15, 2026

Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer accounts to elevate their permissions within the multivendor marketplace, potentially gaining vendor or administrative capabilities. The flaw was disclosed via Patchstack and carries a CVSS 3.1 score of 8.8 with high impact across confidentiality, integrity, and availability; no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.

RemediationAI

Patch available per vendor advisory: upgrade Dokan to a release later than 5.0.2 as soon as weDevs publishes the fixed build referenced in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/dokan-lite/vulnerability/wordpress-dokan-plugin-5-0-2-privilege-escalation-vulnerability, and verify the installed version via Plugins → Installed Plugins after updating. Until the fixed version is deployed, compensating controls include temporarily disabling new customer self-registration in WooCommerce/Dokan settings (trade-off: blocks legitimate signups and lost sales), placing the site behind Patchstack's or another WordPress WAF with virtual-patching rules for this CVE (trade-off: depends on signature coverage and may not catch variant payloads), auditing the wp_users and wp_usermeta tables for unexpected role escalations to vendor or administrator, and restricting access to Dokan vendor-management AJAX/REST endpoints via web-server ACLs (trade-off: may break legitimate vendor workflows). Do not rely on plugin deactivation alone if customer accounts have already been created - audit existing accounts before re-enabling.

Affected VersionsENISA

Dokan n/a ≤5.0.2

Affected Packages

euvd dokan no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Dokan (also marketed as Dokan Lite) is a popular WordPress multivendor marketplace plugin that lets site owners run Amazon/Etsy-style storefronts with distinct customer, vendor, and admin roles layered on top of WordPress and WooCommerce capabilities. The underlying weakness maps to CWE-266 (Incorrect Privilege Assignment), meaning the plugin assigns or accepts privilege/role values without sufficient validation, so a logged-in customer can manipulate a request to receive capabilities they were never granted. The CPE 'cpe:2.3:a:dokan,_inc.:dokan:*:*:*:*:*:*:*:*' indicates all Dokan versions up to and including 5.0.2 are in scope.

Know when Dokan gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network-reachable WordPress endpoint (AV:N), straightforward request (AC:L), requires a self-registerable customer account (PR:L), no victim interaction (UI:N), and full site-level CIA impact via role escalation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Customer Privilege Escalation in Dokan <= 5.0.2 versions.

Executive ViewAI

Why It Matters

Dokan-powered marketplace operators (versions 5.0.2 and earlier) depend on customer account isolation for operational security-a privilege escalation vulnerability in this plugin eliminates that control boundary, allowing customers to assume administrative roles. No public exploit identified at time of analysis. Absent a vendor patch, organizations face elevated risk of unauthorized marketplace modifications, data breaches, and service disruption.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Implement these mitigations: disable or restrict customer account role modification capabilities via plugin configuration; isolate Dokan instances on separate infrastructure from customer-accessible networks; enforce multi-factor authentication on all administrative account access; deploy real-time monitoring and alerting on privilege escalation attempts; conduct weekly privilege audits comparing authorized versus actual customer account permissions; consider temporary suspension of customer self-service account management features.

Threat Intelligence Overview

EPSS Score

0.3%

Top 80% exploitable

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.