Dokan CVE-2026-8761

Exploitation requires an authenticated WordPress session with the Vendor or Seller role - the minimum role level Dokan assigns to marketplace sellers - consistent with CVSS PR:L. The Dokan plugin must be active and the WordPress REST API must be reachable (default configuration). The flaw is specifically in the CustomersController REST namespace; no non-default plugin settings or special configurations are required to expose the vulnerable endpoint - it is registered unconditionally when the plugin is active. Exploitation is blocked if: (1) the attacker cannot obtain a Vendor/Seller-or-above account; (2) the WordPress REST API is firewalled or rate-limited at the network perimeter; or (3) the Dokan plugin is deactivated. Default WordPress installations without Dokan are entirely unaffected. No user interaction is required - the attacker operates solely through direct API calls.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately represents the technical exposure: the attack is network-reachable, requires no special conditions beyond a vendor-level account, and yields full read/write/delete access to the WordPress user table. The formal scope rating of S:U understates the real-world blast radius - overwriting an administrator's password constitutes de facto full site compromise, which transcends the Dokan plugin's own security domain. No EPSS score or KEV listing appears in the provided data, so exploitation probability cannot be precisely quantified; however, the attack mechanics are straightforward REST API interactions requiring no special tooling, placing the practical exploitation bar very low for any attacker who holds or can register a vendor account. The PR:L prerequisite is a meaningful limiting factor on shared marketplaces with strict vendor vetting, but on open-registration multivendor stores the realistic attack surface is broad. The high C/I/A triad is well-supported: confidentiality (read any user's data), integrity (modify any user's password/role), and availability (delete any user account) are all fully achievable.

An attacker registers as a vendor on a Dokan-powered WooCommerce marketplace and obtains a session cookie or application password. The attacker enumerates WordPress user IDs by iterating GET requests against /wp-json/dokan/v1/customers/{id} until an administrator account is identified via role metadata in the response. The attacker then issues a PUT request to the same endpoint with a controlled password value, which the plugin accepts and applies without validating that the target is a privileged user, yielding full administrative access to the WordPress installation. No public exploit code has been identified at time of analysis.