Dokan Multivendor EUVD-2026-52184

Exploitation requires a valid Dokan vendor account on the target WordPress/WooCommerce marketplace (PR:L per CVSS). Unauthenticated users cannot exploit this vulnerability. The WordPress REST API must be reachable over the network, which is the default configuration for all WordPress installations; no non-default setting is required. The vulnerable code path is triggered by sending a bulk order-status update request to the Dokan REST endpoint with attacker-controlled order IDs belonging to other accounts. Limiting factors: the attacker must complete vendor registration, which may require marketplace operator approval on tightly managed platforms; the impact is strictly limited to order status manipulation - no confidential data (C:N) or system availability (A:N) is affected per CVSS vector. Open-registration marketplaces face significantly higher realistic risk than those with controlled vendor onboarding.

The CVSS 3.1 score of 4.3 (Medium) accurately reflects the constrained impact: the attack is network-accessible with low complexity (AV:N/AC:L), but requires a valid vendor account (PR:L) and yields only a limited integrity impact (I:L) - no data exfiltration is possible (C:N). EPSS at 0.13% (3rd percentile) reinforces that this vulnerability has seen very low observed exploitation, consistent with the requirement for prior account registration. No KEV listing confirms no confirmed active exploitation at time of analysis. However, the presence of a publicly available POC elevates the real-world threat above what EPSS alone suggests. The business impact to marketplace operators can exceed the CVSS score implies: an adversarial vendor could cancel competitor orders, falsely mark orders as completed or refunded, or disrupt customer fulfillment workflows - causing financial and reputational harm disproportionate to the 4.3 score. Priority should be elevated for public-facing multi-vendor marketplaces where vendor account registration is open.

An attacker who holds or registers a vendor account on a vulnerable marketplace enumerates order IDs - which may be predictable sequential integers or discoverable through normal vendor activity - then submits a crafted bulk status-change request to the Dokan REST endpoint referencing those foreign order IDs. A publicly available POC exists demonstrating this technique, meaning the attack requires minimal technical skill. The attacker can mark competitor orders as cancelled or refunded, disrupting fulfillment and triggering financial disputes without needing any elevated privileges beyond the vendor account.