Dokan
Monthly
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenticated Shop Managers to install and activate arbitrary WordPress plugins via the Dokan admin REST API. The plugin's capability check on these endpoints validates only for WooCommerce management capability rather than the required Dokan plugin-installation capability, granting Shop Managers an escalated privilege not intended for their role. With publicly available exploit code and a vendor-released patch, this warrants immediate remediation on any WordPress site running Dokan with untrusted shop manager accounts.
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any authenticated vendor or seller to read, modify, or delete any WordPress user account - including site administrators - via REST API calls to `/wp-json/dokan/v1/customers/{id}`. The plugin's `CustomersController` re-registers WooCommerce's customer CRUD routes but replaces the native `manage_woocommerce` capability gate with a flawed check that inspects only the requesting user's role and never validates authorization against the target user. Setting the `password` parameter on an administrator's record via a PUT request yields full site takeover. No public exploit identified at time of analysis, though the attack is mechanically trivial for any Vendor-role account holder.
Authenticated SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (versions <= 5.0.2) allows a low-privileged Subscriber-level user to inject malicious SQL into backend database queries, enabling extraction of sensitive data across the WordPress store. Reported by Patchstack and rated CVSS 7.1, the scope-changed vector reflects that a compromised low-tier account can reach data beyond its own authorization boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding only subscriber-level privileges to inject a crafted serialized PHP object, which - if a suitable gadget chain exists in the plugin or its dependencies - can lead to high-impact compromise of confidentiality, integrity, and availability. Reported by Patchstack and tracked as CVE-2026-65493 (CWE-502), it carries a CVSS 3.1 score of 7.5 with high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in the Dokan (dokan-lite) WordPress multivendor marketplace plugin, versions up to and including 5.0.6, lets a remote attacker inject script that executes in a victim's browser when they follow a crafted link. Reported by Patchstack (CWE-79) and rated CVSS 7.1, the scope-changed vector reflects that injected script runs in the user's authenticated WordPress session context. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; exploitation requires the target to click an attacker-supplied URL.
Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer accounts to elevate their permissions within the multivendor marketplace, potentially gaining vendor or administrative capabilities. The flaw was disclosed via Patchstack and carries a CVSS 3.1 score of 8.8 with high impact across confidentiality, integrity, and availability; no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
An authentication bypass vulnerability exists in Dokan (Dokan, Inc.) dokan-lite plugin versions through 4.2.4 that allows attackers to abuse authentication mechanisms via an alternate path or channel, potentially gaining unauthorized access without valid credentials. This issue affects the popular WordPress e-commerce plugin used by multivendor marketplace sites. The vulnerability has been identified by Patchstack and tracked under EUVD-2026-15555, though CVSS scoring and active exploitation data are not yet available.
Financial ledger manipulation in the Dokan WooCommerce Multivendor Marketplace WordPress plugin (before 5.0.14) allows authenticated vendors to fraudulently clear commission debts by submitting arbitrary client-supplied payment amounts to the reverse-withdrawal endpoint without server-side balance validation. Any registered vendor on an affected marketplace can exploit this to zero out real outstanding commissions owed to the marketplace operator, constituting financial fraud against the site owner. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV, though the low attack complexity and accessible vendor registration on most marketplaces make this a meaningful business risk.
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allows any remote actor to retrieve per-vendor commission configuration from an unprotected store REST endpoint without credentials. The exposed data includes commission type and, where category-based commissions are configured, per-category and default commission rates - leaking potentially sensitive business financial details for every vendor on the marketplace. A publicly available proof-of-concept exists; however, active exploitation has not been confirmed via CISA KEV.
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level authorization flaw in one of its order REST API endpoints, enabling any authenticated vendor to grant their own customers free download access to paid downloadable files belonging to other vendors without the file owner's consent. Publicly available exploit code exists for this issue, reported by WPScan. Despite a CVSS score of 5.4 (Medium) and confirmed POC availability, the EPSS probability of 0.13% (3rd percentile) indicates that widespread automated exploitation is not currently observed, though the business impact - unauthorized file distribution and revenue theft across a multivendor marketplace - is directly harmful to affected platform operators.
Broken access control in the Dokan WordPress multi-vendor marketplace plugin (all versions through 5.0.10) allows network-accessible exploitation of its custom role permission system, enabling unauthorized integrity-affecting actions. The flaw stems from CWE-862 (Missing Authorization), where the plugin fails to verify whether a requester holds the appropriate capability before executing role-gated operations. No public exploit code or CISA KEV listing exists at time of analysis; CVSS rates this medium severity (5.3), with the original vector asserting no privileges required and no user interaction.
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor on a multivendor marketplace to overwrite product attributes and default attributes belonging to other vendors via the plugin's REST API write endpoints. Exploitation requires only a low-privilege vendor account - no admin access needed - making this accessible to any registered seller on the platform. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited observed exploitation activity so far; the vulnerability is not listed in CISA KEV.
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to modify the status of arbitrary WooCommerce orders across the entire marketplace, including orders owned by other vendors and customers. The flaw stems from a REST endpoint handling bulk order-status changes that accepts attacker-supplied order IDs without verifying the requesting vendor's ownership of those orders. No active exploitation is confirmed (not in CISA KEV), but a publicly available proof-of-concept exists and EPSS at 0.13% (3rd percentile) reflects low observed exploitation to date.
Stored Cross-Site Scripting in the Dokan WooCommerce Multivendor Marketplace plugin for WordPress (all versions through 5.0.4) allows any authenticated vendor-level user to permanently inject arbitrary JavaScript into product SKU fields, which then executes in the browsers of all site visitors - including unauthenticated users - via the store search widget's AJAX response path. The scope change (S:C in CVSS) is critical: the attacker plants the payload once as a vendor, but impact is borne by an unbounded population of end users who trigger the search widget. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the attack surface is wide on marketplaces with open vendor registration.
Insecure Direct Object Reference in Dokan WooCommerce Multivendor Marketplace plugin (all versions through 5.0.4) enables horizontal privilege escalation across vendor accounts via the REST API 'id' parameter. Authenticated attackers holding any vendor-level or subscriber-level account can retrieve full product records belonging to competing vendors, including unpublished draft and pending-review listings that expose product names, prices, SKUs, and descriptions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Insecure Direct Object Reference across six AJAX handlers in the Dokan multivendor marketplace plugin for WordPress allows authenticated vendor-level users to manipulate arbitrary marketplace orders they do not own, in all versions up to and including 5.0.3. Affected operations include changing order status, injecting customer-facing notes that trigger WooCommerce notification emails to buyers, deleting any order note or WordPress comment by raw ID, inserting fraudulent shipping tracking data, and granting or revoking downloadable product access on any order in the installation. The nonce-based CSRF protection provides no ownership barrier because vendors legitimately generate valid nonces from their own dashboard pages and can replay them against any order ID - no public exploit identified at time of analysis, though vulnerable code paths are confirmed in source at version 5.0.1 by Wordfence.
Unauthenticated remote attackers can extract sensitive user information including email addresses, usernames, and user IDs through the '/dokan/v1/stores/{id}/reviews' REST API endpoint in Dokan plugin versions up to 4.3.1. The vulnerability affects only installations with the Pro version activated and store reviews enabled, allowing information disclosure of all customers who left vendor reviews. No public exploit code has been identified, but the attack requires no authentication or user interaction and can be automated at scale.
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 89.5%.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan - Best WooCommerce Multivendor Marketplace Solution - Build Your Own Amazon, eBay,. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in weDevs Dokan - Best WooCommerce Multivendor Marketplace Solution - Build Your Own Amazon, eBay, Etsy.7.19. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenticated Shop Managers to install and activate arbitrary WordPress plugins via the Dokan admin REST API. The plugin's capability check on these endpoints validates only for WooCommerce management capability rather than the required Dokan plugin-installation capability, granting Shop Managers an escalated privilege not intended for their role. With publicly available exploit code and a vendor-released patch, this warrants immediate remediation on any WordPress site running Dokan with untrusted shop manager accounts.
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any authenticated vendor or seller to read, modify, or delete any WordPress user account - including site administrators - via REST API calls to `/wp-json/dokan/v1/customers/{id}`. The plugin's `CustomersController` re-registers WooCommerce's customer CRUD routes but replaces the native `manage_woocommerce` capability gate with a flawed check that inspects only the requesting user's role and never validates authorization against the target user. Setting the `password` parameter on an administrator's record via a PUT request yields full site takeover. No public exploit identified at time of analysis, though the attack is mechanically trivial for any Vendor-role account holder.
Authenticated SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (versions <= 5.0.2) allows a low-privileged Subscriber-level user to inject malicious SQL into backend database queries, enabling extraction of sensitive data across the WordPress store. Reported by Patchstack and rated CVSS 7.1, the scope-changed vector reflects that a compromised low-tier account can reach data beyond its own authorization boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding only subscriber-level privileges to inject a crafted serialized PHP object, which - if a suitable gadget chain exists in the plugin or its dependencies - can lead to high-impact compromise of confidentiality, integrity, and availability. Reported by Patchstack and tracked as CVE-2026-65493 (CWE-502), it carries a CVSS 3.1 score of 7.5 with high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in the Dokan (dokan-lite) WordPress multivendor marketplace plugin, versions up to and including 5.0.6, lets a remote attacker inject script that executes in a victim's browser when they follow a crafted link. Reported by Patchstack (CWE-79) and rated CVSS 7.1, the scope-changed vector reflects that injected script runs in the user's authenticated WordPress session context. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; exploitation requires the target to click an attacker-supplied URL.
Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer accounts to elevate their permissions within the multivendor marketplace, potentially gaining vendor or administrative capabilities. The flaw was disclosed via Patchstack and carries a CVSS 3.1 score of 8.8 with high impact across confidentiality, integrity, and availability; no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
An authentication bypass vulnerability exists in Dokan (Dokan, Inc.) dokan-lite plugin versions through 4.2.4 that allows attackers to abuse authentication mechanisms via an alternate path or channel, potentially gaining unauthorized access without valid credentials. This issue affects the popular WordPress e-commerce plugin used by multivendor marketplace sites. The vulnerability has been identified by Patchstack and tracked under EUVD-2026-15555, though CVSS scoring and active exploitation data are not yet available.
Financial ledger manipulation in the Dokan WooCommerce Multivendor Marketplace WordPress plugin (before 5.0.14) allows authenticated vendors to fraudulently clear commission debts by submitting arbitrary client-supplied payment amounts to the reverse-withdrawal endpoint without server-side balance validation. Any registered vendor on an affected marketplace can exploit this to zero out real outstanding commissions owed to the marketplace operator, constituting financial fraud against the site owner. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV, though the low attack complexity and accessible vendor registration on most marketplaces make this a meaningful business risk.
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allows any remote actor to retrieve per-vendor commission configuration from an unprotected store REST endpoint without credentials. The exposed data includes commission type and, where category-based commissions are configured, per-category and default commission rates - leaking potentially sensitive business financial details for every vendor on the marketplace. A publicly available proof-of-concept exists; however, active exploitation has not been confirmed via CISA KEV.
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level authorization flaw in one of its order REST API endpoints, enabling any authenticated vendor to grant their own customers free download access to paid downloadable files belonging to other vendors without the file owner's consent. Publicly available exploit code exists for this issue, reported by WPScan. Despite a CVSS score of 5.4 (Medium) and confirmed POC availability, the EPSS probability of 0.13% (3rd percentile) indicates that widespread automated exploitation is not currently observed, though the business impact - unauthorized file distribution and revenue theft across a multivendor marketplace - is directly harmful to affected platform operators.
Broken access control in the Dokan WordPress multi-vendor marketplace plugin (all versions through 5.0.10) allows network-accessible exploitation of its custom role permission system, enabling unauthorized integrity-affecting actions. The flaw stems from CWE-862 (Missing Authorization), where the plugin fails to verify whether a requester holds the appropriate capability before executing role-gated operations. No public exploit code or CISA KEV listing exists at time of analysis; CVSS rates this medium severity (5.3), with the original vector asserting no privileges required and no user interaction.
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor on a multivendor marketplace to overwrite product attributes and default attributes belonging to other vendors via the plugin's REST API write endpoints. Exploitation requires only a low-privilege vendor account - no admin access needed - making this accessible to any registered seller on the platform. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited observed exploitation activity so far; the vulnerability is not listed in CISA KEV.
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to modify the status of arbitrary WooCommerce orders across the entire marketplace, including orders owned by other vendors and customers. The flaw stems from a REST endpoint handling bulk order-status changes that accepts attacker-supplied order IDs without verifying the requesting vendor's ownership of those orders. No active exploitation is confirmed (not in CISA KEV), but a publicly available proof-of-concept exists and EPSS at 0.13% (3rd percentile) reflects low observed exploitation to date.
Stored Cross-Site Scripting in the Dokan WooCommerce Multivendor Marketplace plugin for WordPress (all versions through 5.0.4) allows any authenticated vendor-level user to permanently inject arbitrary JavaScript into product SKU fields, which then executes in the browsers of all site visitors - including unauthenticated users - via the store search widget's AJAX response path. The scope change (S:C in CVSS) is critical: the attacker plants the payload once as a vendor, but impact is borne by an unbounded population of end users who trigger the search widget. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the attack surface is wide on marketplaces with open vendor registration.
Insecure Direct Object Reference in Dokan WooCommerce Multivendor Marketplace plugin (all versions through 5.0.4) enables horizontal privilege escalation across vendor accounts via the REST API 'id' parameter. Authenticated attackers holding any vendor-level or subscriber-level account can retrieve full product records belonging to competing vendors, including unpublished draft and pending-review listings that expose product names, prices, SKUs, and descriptions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Insecure Direct Object Reference across six AJAX handlers in the Dokan multivendor marketplace plugin for WordPress allows authenticated vendor-level users to manipulate arbitrary marketplace orders they do not own, in all versions up to and including 5.0.3. Affected operations include changing order status, injecting customer-facing notes that trigger WooCommerce notification emails to buyers, deleting any order note or WordPress comment by raw ID, inserting fraudulent shipping tracking data, and granting or revoking downloadable product access on any order in the installation. The nonce-based CSRF protection provides no ownership barrier because vendors legitimately generate valid nonces from their own dashboard pages and can replay them against any order ID - no public exploit identified at time of analysis, though vulnerable code paths are confirmed in source at version 5.0.1 by Wordfence.
Unauthenticated remote attackers can extract sensitive user information including email addresses, usernames, and user IDs through the '/dokan/v1/stores/{id}/reviews' REST API endpoint in Dokan plugin versions up to 4.3.1. The vulnerability affects only installations with the Pro version activated and store reviews enabled, allowing information disclosure of all customers who left vendor reviews. No public exploit code has been identified, but the attack requires no authentication or user interaction and can be automated at scale.
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 89.5%.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan - Best WooCommerce Multivendor Marketplace Solution - Build Your Own Amazon, eBay,. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in weDevs Dokan - Best WooCommerce Multivendor Marketplace Solution - Build Your Own Amazon, eBay, Etsy.7.19. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.