What is the CVSS score of CVE-2026-65495?

CVE-2026-65495 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Dokan Pro are affected by CVE-2026-65495?

Dokan Pro through version 5.0.3 contains broken access control allowing unauthenticated attackers to bypass authorization checks on marketplace functions, creating risk of operational disruption to…

How to fix or mitigate CVE-2026-65495?

Within 24 hours: Scan all WordPress infrastructure to identify Dokan Pro instances running version 5.0.3 or earlier; document inventory and assess business criticality of each affected marketplace. Implement Web Application Firewall (WAF) rules to enforce authentication on marketplace administrative and sensitive API endpoints, and enable detailed logging of all unauthenticated requests to marketplace functions. Within 7 days: Deploy real-time alerting for suspicious unauthenticated access patterns, validate WAF rule effectiveness in a staging environment, and establish incident response runbooks for marketplace availability degradation. Within 30 days: Monitor Dokan's official security channels for patch availability; when released, conduct security testing of the patched version in a non-production environment before deploying to production instances running 5.0.3 or earlier.

Dokan Pro CVE-2026-65495

EUVD-2026-48106 HIGH

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-3g3v-h89c-wr8p

WordPress Authentication Bypass Wordpress Plugin Dokan Pro

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint reachable with low complexity (PR:N/AC:L/AV:N); vendor data records only availability impact, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:31 vuln.today

CVE Published

Jul 23, 2026 - 11:19 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.

AnalysisAI

Broken access control in Dokan Pro (the premium extension of the Dokan multivendor marketplace plugin for WordPress) through version 5.0.3 lets unauthenticated remote attackers reach functionality that should be authorization-gated, per Patchstack's advisory. The published CVSS vector scores only an availability impact (C:N/I:N/A:H), indicating the missing authorization check can be abused to disrupt or degrade marketplace operations rather than to read or alter data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Dokan Pro is a commercial add-on to the widely used Dokan WordPress plugin, which turns WooCommerce stores into multi-vendor marketplaces; the affected component is identified by CPE cpe:2.3:a:dokan_multivendor_plugin:dokan_pro:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints/actions execute without verifying that the caller holds the required capability or role, so requests from unauthenticated visitors are honored. In WordPress plugin architecture this typically stems from AJAX/REST or admin-post handlers that omit current_user_can() or nonce/capability checks, exposing vendor- or admin-scoped operations to anonymous callers.

RemediationAI

Upgrade Dokan Pro to a release later than 5.0.3 once available from the vendor; the input does not include an exact fixed version, so treat 'the next release above 5.0.3' as the target and confirm the patched version against WeDevs/Patchstack before deploying - no vendor-released patch version is independently confirmed at time of analysis. Consult the advisory at https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-3-broken-access-control-vulnerability for the fixed build. Until a patched version is applied, restrict access to the vulnerable plugin endpoints at the web/WAF layer (for example a Patchstack virtual patch or WAF rule blocking anonymous requests to the affected Dokan AJAX/REST actions), which mitigates the availability abuse but may break legitimate front-end vendor/marketplace features if rules are too broad; if the marketplace is not in active use, deactivating Dokan Pro fully removes exposure at the cost of disabling multivendor functionality.