EUVD-2026-53037
GHSA-q7fj-7hxw-7x69
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible REST endpoint, no special conditions, requires only Vendor-role authentication (PR:L); full user read/write/delete access justifies C:H/I:H/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the CustomersController REST controller (includes/REST/CustomersController.php), which re-registers WooCommerce's customer CRUD routes under the /dokan/v1/customers/ namespace and replaces WooCommerce's native manage_woocommerce capability check with a vendor-only check that inspects the requesting user's role and never validates the target user. This makes it possible for authenticated attackers with Vendor/Seller-level access and above to read, modify, or delete any WordPress user - including administrators - via GET/PUT/DELETE requests against /wp-json/dokan/v1/customers/{id}. Setting the password parameter on an administrator's record yields a full site takeover.
AnalysisAI
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any authenticated vendor or seller to read, modify, or delete any WordPress user account - including site administrators - via REST API calls to /wp-json/dokan/v1/customers/{id}. The plugin's CustomersController re-registers WooCommerce's customer CRUD routes but replaces the native manage_woocommerce capability gate with a flawed check that inspects only the requesting user's role and never validates authorization against the target user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with the Vendor or Seller role - the minimum role level Dokan assigns to marketplace sellers - consistent with CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately represents the technical exposure: the attack is network-reachable, requires no special conditions beyond a vendor-level account, and yields full read/write/delete access to the WordPress user table. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers as a vendor on a Dokan-powered WooCommerce marketplace and obtains a session cookie or application password. The attacker enumerates WordPress user IDs by iterating GET requests against `/wp-json/dokan/v1/customers/{id}` until an administrator account is identified via role metadata in the response. … |
| Remediation | Update the Dokan plugin to version 5.0.2 or later; because the provided changeset reference spans 5.0.2 through 5.0.3, updating to 5.0.3 is recommended to ensure the complete fix is applied. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable the Dokan plugin entirely if operationally feasible, or immediately restrict vendor access to the /wp-json/dokan/v1/customers/* REST API endpoints using firewall or Web Application Firewall rules if the plugin is business-critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today