Dokan EUVD-2026-37835

Exploitation requires an authenticated account with Dokan vendor (seller) role or higher on the target WordPress installation - attacker must be a registered marketplace vendor, not merely a customer or anonymous user. The attacker must have at least one order of their own to load a dashboard order page and harvest a valid WordPress nonce; this is the only prerequisite beyond holding a vendor account. The WordPress site must have the Dokan plugin active with WooCommerce installed in its standard multivendor configuration - no non-default settings are required. Limiting factors: the vendor account requirement (PR:L) is the primary gate, and exploitation is strictly scoped to the same WordPress installation (no cross-site impact). The nonce does not limit exploitation because vendors generate valid nonces on demand from their own dashboard - this was the specific prior-rejection reasoning that Wordfence rebutted. Exploitation does not require any action by the victim order owner or buyer (UI:N).

The official CVSS score of 4.3 Medium with AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N represents a defensible but conservative rating of this vulnerability. The PR:L requirement - a registered vendor account - is the primary limiting factor, and in typical marketplace deployments vendor registration may be open or low-friction, reducing the practical barrier. The aggregate real-world integrity impact is broader than I:L alone implies: a single vendor account enables cross-order status falsification, injection of customer-facing emails (a social engineering channel against buyers), silent deletion of transaction records, and unauthorized grant of digital product access across the entire marketplace. No EPSS data was provided, no KEV listing exists, and no public exploit code has been identified - risk is primarily from malicious insider vendors rather than external opportunistic attackers. The S:U (no scope change) is consistent with the impact being confined to the WooCommerce order dataset, though the buyer notification email side-effect introduces an out-of-band social engineering surface not captured by CVSS. CVSS and real-world risk are broadly aligned here, with the caveat that the breadth of manipulation per authenticated request may justify an I:M reassessment by site operators in high-volume marketplace contexts.

A malicious vendor registered on the marketplace navigates to their own order dashboard at /dashboard/orders/?order_id=[OWN_ORDER_ID] and extracts the embedded WordPress nonce from the page HTML. They then POST to wp-admin/admin-ajax.php with action=dokan_change_order_status, the harvested nonce, and a victim's order_id to flip the victim's order to a completed or cancelled state - or use add_order_note to send a fraudulent customer-facing note that triggers a WooCommerce email to the buyer with attacker-controlled text. No public exploit code is known, but the technique requires only a browser developer console or standard HTTP proxy and a legitimate vendor account on the target marketplace.