What is the CVSS score of CVE-2026-49780?

CVE-2026-49780 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Dokan are affected by CVE-2026-49780?

Dokan-powered marketplace operators (versions 5.0.2 and earlier) depend on customer account isolation for operational security-a privilege escalation vulnerability in this plugin eliminates that…

How to fix or mitigate CVE-2026-49780?

Within 24 hours: Identify all WordPress instances running Dokan versions 5.0.2 or earlier; assess which customer accounts have suspicious privilege levels; restrict API and database access to administrative functions. Within 7 days: Disable customer privilege-elevation features in Dokan settings if available; implement strict role-based access controls; activate comprehensive logging on account and permission changes. Within 30 days: Obtain explicit confirmation from Dokan vendors on patch timeline; if no patch is forthcoming, evaluate migration to alternative marketplace platforms; execute forensic audit of all customer account privilege escalations since deployment.

Dokan CVE-2026-49780

EUVD-2026-36897 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-06-15 Patchstack

GHSA-9grp-3x37-pqm5

Privilege Escalation Dokan

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint (AV:N), straightforward request (AC:L), requires a self-registerable customer account (PR:L), no victim interaction (UI:N), and full site-level CIA impact via role escalation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:28 vuln.today

DescriptionCVE.org

Customer Privilege Escalation in Dokan <= 5.0.2 versions.

AnalysisAI

Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer accounts to elevate their permissions within the multivendor marketplace, potentially gaining vendor or administrative capabilities. The flaw was disclosed via Patchstack and carries a CVSS 3.1 score of 8.8 with high impact across confidentiality, integrity, and availability; no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Dokan (also marketed as Dokan Lite) is a popular WordPress multivendor marketplace plugin that lets site owners run Amazon/Etsy-style storefronts with distinct customer, vendor, and admin roles layered on top of WordPress and WooCommerce capabilities. The underlying weakness maps to CWE-266 (Incorrect Privilege Assignment), meaning the plugin assigns or accepts privilege/role values without sufficient validation, so a logged-in customer can manipulate a request to receive capabilities they were never granted. The CPE 'cpe:2.3:a:dokan,_inc.:dokan:*:*:*:*:*:*:*:*' indicates all Dokan versions up to and including 5.0.2 are in scope.

RemediationAI

Patch available per vendor advisory: upgrade Dokan to a release later than 5.0.2 as soon as weDevs publishes the fixed build referenced in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/dokan-lite/vulnerability/wordpress-dokan-plugin-5-0-2-privilege-escalation-vulnerability, and verify the installed version via Plugins → Installed Plugins after updating. Until the fixed version is deployed, compensating controls include temporarily disabling new customer self-registration in WooCommerce/Dokan settings (trade-off: blocks legitimate signups and lost sales), placing the site behind Patchstack's or another WordPress WAF with virtual-patching rules for this CVE (trade-off: depends on signature coverage and may not catch variant payloads), auditing the wp_users and wp_usermeta tables for unexpected role escalations to vendor or administrator, and restricting access to Dokan vendor-management AJAX/REST endpoints via web-server ACLs (trade-off: may break legitimate vendor workflows). Do not rely on plugin deactivation alone if customer accounts have already been created - audit existing accounts before re-enabling.