Skip to main content

Dokan Marketplace Plugin EUVDEUVD-2026-63818

| CVE-2026-16576 HIGH
Improper Access Control (CWE-284)
2026-08-21 WPScan GHSA-vqf4-66cf-wcw6
Authentication Bypass WordPress Dokan
7.2
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
7.2 HIGH
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.2 HIGH

Network-accessible REST API requires Shop Manager auth (PR:H); no interaction needed; arbitrary plugin install yields full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 21, 2026 - 13:23 vuln.today
CVSS changed
Aug 21, 2026 - 13:22 NVD
7.2 (HIGH)
Patch available
Aug 21, 2026 - 07:16 EUVD
CVE Published
Aug 21, 2026 - 06:00 cve.org
HIGH 7.2
CVE Published
Aug 21, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.

Articles & Coverage 1

News 5 New WordPress Vulnerabilities - 1 Critical, 4 High, 3 With POC Aug 22, 2026

AnalysisAI

Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenticated Shop Managers to install and activate arbitrary WordPress plugins via the Dokan admin REST API. The plugin's capability check on these endpoints validates only for WooCommerce management capability rather than the required Dokan plugin-installation capability, granting Shop Managers an escalated privilege not intended for their role. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain Shop Manager credentials
Delivery
Send crafted REST API request to Dokan plugin-install endpoint
Exploit
Bypass capability check (WooCommerce vs. Dokan install capability)
Execution
Install malicious plugin from WordPress.org
Impact
Achieve remote code execution on server
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated WordPress session with Shop Manager role or any role holding the WooCommerce management capability (manage_woocommerce). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately reflects the network-exploitable, high-privilege-required nature of this flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a Shop Manager account on a Dokan-powered WooCommerce site sends a crafted REST API request to a Dokan admin plugin-install endpoint, which passes the capability check because the site's Shop Manager role holds WooCommerce management capability. The attacker installs a backdoored or malicious plugin from WordPress.org, achieving remote code execution under the web server process. …
Remediation The primary fix is to upgrade the Dokan plugin to version 5.0.14 or later, which corrects the capability check on the affected admin REST API routes. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit your WordPress installation to identify all active Shop Manager accounts and assess whether each represents a trusted internal actor; disable plugin management access for any delegated or third-party accounts pending patching. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Dokan

View all
CVE-2024-3922 CRITICAL POC
10.0 Jun 13

The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and in
CVE-2022-3915 CRITICAL POC
9.8 Dec 12

The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL state
CVE-2026-16574 MEDIUM POC
5.4 Aug 08

Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level auth
CVE-2026-16575 MEDIUM POC
5.3 Aug 21

Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allo
CVE-2026-8761 HIGH
8.8 Aug 05

Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any

CVE-2026-24359 HIGH
8.8 Mar 25

An authentication bypass vulnerability exists in Dokan (Dokan, Inc.) dokan-lite plugin versions through 4.2.4 that allow
CVE-2026-49780 HIGH
8.8 Jun 15

Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer a
CVE-2026-16565 MEDIUM POC
4.3 Aug 03

Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor

CVE-2026-16564 MEDIUM POC
4.3 Aug 03

Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to mod
CVE-2020-36748 MEDIUM POC
4.3 Jul 01

The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. Rate
CVE-2023-26525 HIGH
7.1 Dec 20

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan - Bes
CVE-2026-57706 HIGH
7.1 Jul 13

Reflected cross-site scripting in the Dokan (dokan-lite) WordPress multivendor marketplace plugin, versions up to and in

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-63818 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy