EUVD-2026-48106
GHSA-3g3v-h89c-wr8p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Dokan Pro ≤5.0.3
-
ExploitSend unauthenticated request to unprotected endpoint
-
ExecutionBypass missing authorization check
-
ImpactDisrupt marketplace availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a WordPress site running the Dokan Pro plugin at version 5.0.3 or earlier with the vulnerable, network-reachable endpoint exposed to the internet; no authentication, credentials, or user interaction is needed (CVSS PR:N/UI:N), and attack complexity is low. The limiting factors are deployment-specific: the target must have Dokan Pro (not merely Dokan Lite) installed and active and the affected feature reachable, and the confirmed impact is availability only (C:N/I:N), so this enables disruption rather than data theft or modification based on the vendor-assigned vector. The exact vulnerable action/parameter is not detailed in the available data and should be confirmed via the Patchstack advisory. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a low-complexity, network-reachable, unauthenticated flaw with no user interaction - attractive on paper - but the impact metrics are unusually narrow: C:N/I:N/A:H, meaning only availability is affected, which is why the base score lands at 7.5 (High) rather than Critical. There is no EPSS value provided, no POC noted, and no KEV listing, so there is currently no signal of active or automated exploitation; the risk is credible but presently theoretical. Note a tension in the data: the tag 'Authentication Bypass' and the 'Broken Access Control' label often imply confidentiality/integrity consequences, yet the vendor-assigned vector records impact only to availability - verify the concrete affected action with Patchstack, because if data exposure or modification is in fact possible the real severity would be higher than the availability-only vector suggests. |
| Exploit ScenarioDerived | An anonymous attacker sends crafted HTTP requests directly to a Dokan Pro endpoint that lacks a capability check, triggering a marketplace operation reserved for authenticated vendors or admins and disrupting store availability. Because no authentication or user interaction is required (PR:N/UI:N/AC:L), the requests can be scripted and repeated at scale. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Broken access control in Dokan Pro (the premium extension of the Dokan multivendor marketplace plugin for WordPress) through version 5.0.3 lets unauthenticated remote attackers reach functionality that should be authorization-gated, per Patchstack's advisory. The published CVSS vector scores only an availability impact (C:N/I:N/A:H), indicating the missing authorization check can be abused to disrupt or degrade marketplace operations rather than to read or alter data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Upgrade Dokan Pro to a release later than 5.0.3 once available from the vendor; the input does not include an exact fixed version, so treat 'the next release above 5.0.3' as the target and confirm the patched version against WeDevs/Patchstack before deploying - no vendor-released patch version is independently confirmed at time of analysis. Consult the advisory at https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-3-broken-access-control-vulnerability for the fixed build. Until a patched version is applied, restrict access to the vulnerable plugin endpoints at the web/WAF layer (for example a Patchstack virtual patch or WAF rule blocking anonymous requests to the affected Dokan AJAX/REST actions), which mitigates the availability abuse but may break legitimate front-end vendor/marketplace features if rules are too broad; if the marketplace is not in active use, deactivating Dokan Pro fully removes exposure at the cost of disabling multivendor functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dokan Pro is a commercial add-on to the widely used Dokan WordPress plugin, which turns WooCommerce stores into multi-vendor marketplaces; the affected component is identified by CPE cpe:2.3:a:dokan_multivendor_plugin:dokan_pro:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints/actions execute without verifying that the caller holds the required capability or role, so requests from unauthenticated visitors are honored. In WordPress plugin architecture this typically stems from AJAX/REST or admin-post handlers that omit current_user_can() or nonce/capability checks, exposing vendor- or admin-scoped operations to anonymous callers.
Know when Dokan Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network endpoint reachable with low complexity (PR:N/AC:L/AV:N); vendor data records only availability impact, so C:N/I:N/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.
Executive ViewAI
Dokan Pro through version 5.0.3 contains broken access control allowing unauthenticated attackers to bypass authorization checks on marketplace functions, creating risk of operational disruption to WordPress e-commerce sites. No public exploit code has been identified, but the vulnerability remains exploitable until a patch is released. Affected organizations must immediately inventory installations and implement interim controls.
No vendor-released patch identified at time of analysis. Interim mitigations include: configure WAF to require authentication tokens on all marketplace endpoint requests, implement IP-based access restrictions for administrative marketplace functionality, enable rate limiting on API endpoints to constrain denial-of-service impact, deploy enhanced audit logging to detect unauthorized access attempts, and consider temporarily disabling non-critical marketplace features that lack compensating controls. Isolate marketplace databases and payment integrations from direct internet exposure where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation in the Dokan Pro WooCommerce multivendor plugin for WordPress (all versions through 5.0.4) allows a
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding
SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (all versions ≤ 5.0.4) lets unauthenticated remo
Authenticated SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (versions <= 5.0.2) allows a low-p
Stored/reflected Cross-Site Scripting in the Dokan Pro WordPress multivendor marketplace plugin (versions up to and incl
Time-based blind SQL injection in the Dokan Pro WordPress plugin allows network-accessible authenticated attackers with
Exploit-DB