EUVD-2026-52184
GHSA-rgp2-2vg6-97f5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
REST endpoint is network-accessible; vendor account required (PR:L); impact is solely order-status integrity modification with no data exposure or availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk order-status changes, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace, including orders belonging to other vendors and the store's own customers.
AnalysisAI
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to modify the status of arbitrary WooCommerce orders across the entire marketplace, including orders owned by other vendors and customers. The flaw stems from a REST endpoint handling bulk order-status changes that accepts attacker-supplied order IDs without verifying the requesting vendor's ownership of those orders. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Dokan vendor account on the target WordPress/WooCommerce marketplace (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (Medium) accurately reflects the constrained impact: the attack is network-accessible with low complexity (AV:N/AC:L), but requires a valid vendor account (PR:L) and yields only a limited integrity impact (I:L) - no data exfiltration is possible (C:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds or registers a vendor account on a vulnerable marketplace enumerates order IDs - which may be predictable sequential integers or discoverable through normal vendor activity - then submits a crafted bulk status-change request to the Dokan REST endpoint referencing those foreign order IDs. A publicly available POC exists demonstrating this technique, meaning the attack requires minimal technical skill. … |
| Remediation | Update the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin to version 5.0.9 or later, which introduces server-side ownership verification on the bulk order-status REST endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and in
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL state
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenti
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level auth
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allo
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any
An authentication bypass vulnerability exists in Dokan (Dokan, Inc.) dokan-lite plugin versions through 4.2.4 that allow
Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer a
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor
The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. Rate
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan - Bes
Reflected cross-site scripting in the Dokan (dokan-lite) WordPress multivendor marketplace plugin, versions up to and in
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today