# Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Authenticated (Vendor+) Customer Account Takeover via Customers REST Endpoint

- **ID:** WPSEC-2026-0787
- **Plugin:** Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (`dokan-lite`), https://wordpress.org/plugins/dokan-lite/
- **Affected versions:** from 4.0.0 before 5.3.0
- **Fixed in:** 5.3.0 (Update to 5.3.0 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-620
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/dokan-lite
- **Fix released:** 2026-10-08
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0787/

## Description

The Dokan plugin for WordPress is vulnerable to Account Takeover via the customers REST endpoint in versions 4.0.0 up to, and including, 5.2.1, due to the endpoint's permission check not restricting which fields a vendor may change when editing a customer, including the customer's login password and email address. This makes it possible for authenticated attackers with vendor-level access to change the password or login email of customers who have placed an order with their store, and take over those accounts.

## References

- https://wpsec.com/vuln/WPSEC-2026-0787/
- https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.0/
- https://wordpress.org/plugins/dokan-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0787/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.