Vulnerabilities / Dokan: AI Powered WooCommerce Multivendor Marketplace Solution / WPSEC-2026-0787
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Authenticated (Vendor+) Customer Account Takeover via Customers REST Endpoint
High 8.1
CWE-620Fixed in 5.3.0
- ID
- WPSEC-2026-0787
- Plugin
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (dokan-lite)
- Affected
- from 4.0.0 before 5.3.0
- Remediation
- Update to 5.3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-620
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-12
- Attack surface
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution on WPSec AttackSurface
- Fix released
- Published
Description
The Dokan plugin for WordPress is vulnerable to Account Takeover via the customers REST endpoint in versions 4.0.0 up to, and including, 5.2.1, due to the endpoint's permission check not restricting which fields a vendor may change when editing a customer, including the customer's login password and email address. This makes it possible for authenticated attackers with vendor-level access to change the password or login email of customers who have placed an order with their store, and take over those accounts.
References
- https://wpsec.com/vuln/WPSEC-2026-0787/
- https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.0/
- https://wordpress.org/plugins/dokan-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS