Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.3.2 - Unauthenticated Insecure Direct Object Reference to Parent Order Disclosure and Modification via Orders REST API
- ID
- WPSEC-2026-2213
- Plugin
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (dokan-lite)
- Affected
- all versions before 5.3.3
- Remediation
- Update to 5.3.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution on WPSec AttackSurface
- Fix released
- Published
Description
The Dokan plugin for WordPress is vulnerable to Insecure Direct Object Reference via the dokan/v1 and dokan/v2 single-order REST endpoints (/orders/{id}, /orders/{id}/notes and /orders/{id}/downloads) in all versions up to, and including, 5.3.2, due to the get_single_order_permissions_check() permission callback comparing the order's seller ID to the current user ID. Multi-vendor parent orders, and orders with no resolvable vendor, resolve to a seller ID of 0, which matches the user ID of a logged-out visitor. This makes it possible for unauthenticated attackers to read these orders, including customer billing and shipping details, order notes and download permissions, by enumerating order IDs. They can also add order notes, including customer notes that are emailed to the customer, delete order notes, and change or revoke the order's download permissions.
References
- https://wpsec.com/vuln/WPSEC-2026-2213/
- https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.3/
- https://wordpress.org/plugins/dokan-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS