{
 "id": "WPSEC-2026-0787",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0787/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0787/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0787/index.md",
 "title": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Authenticated (Vendor+) Customer Account Takeover via Customers REST Endpoint",
 "description": "The Dokan plugin for WordPress is vulnerable to Account Takeover via the customers REST endpoint in versions 4.0.0 up to, and including, 5.2.1, due to the endpoint's permission check not restricting which fields a vendor may change when editing a customer, including the customer's login password and email address. This makes it possible for authenticated attackers with vendor-level access to change the password or login email of customers who have placed an order with their store, and take over those accounts.",
 "plugin": {
  "slug": "dokan-lite",
  "name": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution",
  "full_name": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy",
  "wordpress_org": "https://wordpress.org/plugins/dokan-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/dokan-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/dokan-lite"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-620"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.0.0",
    "from_inclusive": true,
    "to": "5.3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.0.0 before 5.3.0"
  ]
 },
 "introduced_in": "4.0.0",
 "fixed_in": "5.3.0",
 "remediation": "Update to 5.3.0 or later.",
 "fix_released": "2026-10-08T11:42:19+00:00",
 "published": "2026-10-12T11:49:14+00:00",
 "updated": "2026-10-12T11:06:15.838574+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0787/",
  "https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.0/",
  "https://wordpress.org/plugins/dokan-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/dokan-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-12"
 }
}