Vulnerabilities / Dokan: AI Powered WooCommerce Multivendor Marketplace Solution / WPSEC-2026-2214
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.3.2 - Unauthenticated Sensitive Information Exposure via Product REST API
Medium 5.3
CWE-200Fixed in 5.3.3
- ID
- WPSEC-2026-2214
- Plugin
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (dokan-lite)
- Affected
- all versions before 5.3.3
- Remediation
- Update to 5.3.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution on WPSec AttackSurface
- Fix released
- Published
Description
The Dokan plugin for WordPress is vulnerable to Sensitive Information Exposure via the public product REST endpoints in all versions up to, and including, 5.3.2 due to the shared product serializer returning vendor-only fields to any caller. This makes it possible for unauthenticated attackers to retrieve downloadable product file links, all product meta data, purchase notes, vendor earnings and edit URLs, which may allow access to paid downloadable files without purchasing them.
References
- https://wpsec.com/vuln/WPSEC-2026-2214/
- https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.3/
- https://wordpress.org/plugins/dokan-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS