Dokan CVE-2026-66699

The vulnerability is present when any WordPress installation is running the Dokan plugin at version 5.0.10 or earlier. The CVSS vector (PR:N) asserts that no authenticated session is required, meaning the authorization gap is reachable without a WordPress account; however, the 'custom role' framing introduces ambiguity - exploitation may alternatively require a low-privilege WordPress account (e.g., a registered customer or vendor) whose role is incorrectly granted access to restricted actions. The limiting factor is: impact is constrained to integrity (I:L) only, with no confidentiality or availability consequence, and the scope is unchanged, so a successful exploit modifies data within the plugin's own context rather than escalating to full WordPress admin access. The specific Dokan feature, endpoint name, or configuration flag that triggers the flaw is not disclosed in available public data and must be obtained from the full Patchstack advisory.

The CVSS base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network exploitation with no privileges, no interaction, and limited integrity-only impact. There is a notable tension between the PR:N assertion in the provided vector and the 'custom role' framing of the description - broken access control involving role differentiation typically implies at least some level of authenticated context (PR:L), since role identity must be established. The 'Authentication Bypass' tag partially reconciles this: it is possible that the flaw allows unauthenticated requests to invoke role-restricted functionality by bypassing role validation entirely, which would justify PR:N. No EPSS score was provided, no CISA KEV listing exists, and no POC is publicly documented, all of which reduce real-world urgency. The constrained impact (I:L only, C:N, A:N) further limits blast radius - this is an integrity-affecting issue but does not result in full site compromise or data exfiltration on its own. Priority should scale with the site's reliance on vendor role isolation and whether the affected endpoint can be reached without authentication.

An attacker sends a crafted unauthenticated (or low-privilege authenticated) HTTP request to a Dokan AJAX endpoint or REST route that fails to validate the caller's custom role. The missing authorization check allows the request to succeed, enabling the attacker to modify marketplace data - such as product listings, vendor settings, or order states - that should require elevated role permissions. No public exploit code is documented, so exploitation currently requires manual discovery of the vulnerable endpoint.