What is the CVSS score of CVE-2026-66699?

CVE-2026-66699 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Dokan CVE-2026-66699

EUVD-2026-53904 MEDIUM

Missing Authorization (CWE-862)

2026-08-06 Patchstack

GHSA-585w-jjp9-mj4p

WordPress Authentication Bypass Dokan Wordpress Plugin Dokan Inc

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Custom role context implies at least low-privilege authentication (PR:L); impact is integrity-only and limited in scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:03 vuln.today

CVE Published

Aug 06, 2026 - 14:28 cve.org

MEDIUM 5.3

DescriptionCVE.org

Custom role Broken Access Control in Dokan <= 5.0.10 versions.

AnalysisAI

Broken access control in the Dokan WordPress multi-vendor marketplace plugin (all versions through 5.0.10) allows network-accessible exploitation of its custom role permission system, enabling unauthorized integrity-affecting actions. The flaw stems from CWE-862 (Missing Authorization), where the plugin fails to verify whether a requester holds the appropriate capability before executing role-gated operations. No public exploit code or CISA KEV listing exists at time of analysis; CVSS rates this medium severity (5.3), with the original vector asserting no privileges required and no user interaction.

Technical ContextAI

Dokan (by Dokan, Inc.) is a widely used WordPress plugin that converts a WordPress site into a multi-vendor marketplace, introducing custom user roles such as Vendor/Seller alongside standard WordPress roles. The vulnerability class is CWE-862 (Missing Authorization): one or more AJAX handlers, REST API endpoints, or admin-facing actions fail to call capability checks (e.g., current_user_can()) or nonce validation before executing operations gated to specific custom roles. This is a well-understood WordPress plugin anti-pattern where role logic is implemented in the business layer but the underlying request handler does not enforce it. The CPE cpe:2.3:a:dokan,_inc.:dokan:*:*:*:*:*:*:*:* covers the entire version line through 5.0.10.

RemediationAI

The primary remediation is to update Dokan to a version above 5.0.10, which addresses the missing authorization check. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/dokan-lite/vulnerability/wordpress-dokan-plugin-5-0-10-broken-access-control-vulnerability for the exact fixed version and patch details. If an immediate update is not feasible, a targeted workaround is to restrict access to the vulnerable endpoint(s) at the web server or WAF layer - specifically, block unauthenticated or low-privilege requests to the affected Dokan AJAX action or REST route once identified from the Patchstack advisory. Note that WAF rules may break legitimate marketplace functionality if scoped too broadly. A Patchstack-supplied virtual patch is likely available for Patchstack subscribers as a compensating control pending a code update. The exact patched release version is not independently confirmed in the provided data beyond the Patchstack reference.