What is the CVSS score of EUVD-2026-39696?

EUVD-2026-39696 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Dokan Pro are affected by EUVD-2026-39696?

Dokan Pro multivendor marketplace plugin versions 5.0.4 and earlier contain a critical privilege escalation flaw (CVSS 9.8) enabling unauthenticated attackers to gain full administrative access to…

How to fix or mitigate EUVD-2026-39696?

24 hours: Identify all systems running Dokan Pro ≤5.0.4 and assess operational necessity; prioritize deactivation if non-critical. 7 days: If deactivation not feasible, implement WAF rules blocking /admin and privilege-escalation endpoints, and activate logging on administrative account changes. 30 days: Deploy vendor-released patch for Dokan Pro when available, or complete migration to alternative multivendor platform (WC Vendors, MVX, or equivalent).

Dokan Pro EUVD-2026-39696

| CVE-2026-56033 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-06-26 audit@patchstack.com

GHSA-g44j-q7h3-4266

WordPress Privilege Escalation Wordpress Plugin

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated, network-reachable, low-complexity privilege escalation (PR:N/AV:N/AC:L) yielding administrative control gives full C/I/A; scope unchanged as it stays within the WordPress security authority.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:42 vuln.today

DescriptionCVE.org

Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.

AnalysisAI

Privilege escalation in Dokan Pro (the WordPress/WooCommerce multivendor marketplace plugin) versions 5.0.4 and earlier lets unauthenticated remote attackers gain elevated privileges, scoring CVSS:3.1 9.8 Critical via AV:N/AC:L/PR:N/UI:N with full confidentiality, integrity, and availability impact. The flaw is classed as CWE-266 (Incorrect Privilege Assignment), meaning the plugin grants privileges it should not to an unauthenticated requester. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Dokan Pro is the commercial extension of the Dokan multivendor marketplace plugin for WordPress/WooCommerce, used to turn a store into a multi-seller platform with vendor dashboards, commission handling, and seller account provisioning. The root cause is CWE-266 (Incorrect Privilege Assignment): a code path that creates or modifies user roles/capabilities assigns a higher privilege level than intended, or fails to verify that the requester is authorized to receive it. Because the affected functionality is reachable over the network without authentication (PR:N), that privilege-assignment logic can be driven by an anonymous request rather than only by an authenticated low-privilege user. No CPE strings were supplied in the input, so affected scope is bounded only by the advisory's version statement (Dokan Pro <= 5.0.4).

RemediationAI

No vendor-released patch version is identified in the available data - the input only confirms versions through 5.0.4 are vulnerable, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-4-privilege-escalation-vulnerability?_s_id=cve) and the weDevs/Dokan changelog for the first release above 5.0.4 and upgrade as soon as it is published. Until a fixed version is confirmed and installed, useful compensating controls are placing the site behind a WAF with virtual patching (Patchstack/Wordfence) to filter the malicious privilege-escalation requests, temporarily disabling or tightly restricting vendor self-registration and vendor account-management endpoints if business operations allow (trade-off: blocks new seller onboarding), and auditing wp_users/wp_usermeta and admin-role assignments to detect unauthorized accounts. Network ACLs alone are insufficient since the attack surface is the public web interface.