# Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.3.2 - Unauthenticated Insecure Direct Object Reference to Parent Order Disclosure and Modification via Orders REST API

- **ID:** WPSEC-2026-2213
- **Plugin:** Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (`dokan-lite`), https://wordpress.org/plugins/dokan-lite/
- **Affected versions:** all versions before 5.3.3
- **Fixed in:** 5.3.3 (Update to 5.3.3 or later.)
- **Severity:** High 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/dokan-lite
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2213/

## Description

The Dokan plugin for WordPress is vulnerable to Insecure Direct Object Reference via the dokan/v1 and dokan/v2 single-order REST endpoints (/orders/{id}, /orders/{id}/notes and /orders/{id}/downloads) in all versions up to, and including, 5.3.2, due to the get_single_order_permissions_check() permission callback comparing the order's seller ID to the current user ID. Multi-vendor parent orders, and orders with no resolvable vendor, resolve to a seller ID of 0, which matches the user ID of a logged-out visitor. This makes it possible for unauthenticated attackers to read these orders, including customer billing and shipping details, order notes and download permissions, by enumerating order IDs. They can also add order notes, including customer notes that are emailed to the customer, delete order notes, and change or revoke the order's download permissions.

## References

- https://wpsec.com/vuln/WPSEC-2026-2213/
- https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.3/
- https://wordpress.org/plugins/dokan-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2213/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.