Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.3.3 - Authenticated (Vendor+) Sensitive Information Exposure via Vendor Customers REST Endpoint

ID

WPSEC-2026-2658

Plugin

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (dokan-lite)

Affected

from 4.0.0 before 5.3.4

Remediation

Update to 5.3.4 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness

CWE-200

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-06

Attack surface

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy on WPSec AttackSurface

Fix released

2026-11-05

Published

2026-11-06

Description

The Dokan plugin for WordPress is vulnerable to Sensitive Information Exposure via the dokan/v1/customers REST endpoint in versions 4.0.0 up to, and including, 5.3.3, due to the customer list query not being restricted to the requesting vendor's own customers. Until 5.0.3 all customers were returned; since then the returned rows are only filtered after the query runs, so the total and pagination headers and search matching still cover every customer. This makes it possible for authenticated attackers with vendor-level access to enumerate other registered customers and infer their details, such as email addresses, through search queries and the result count headers.

References

• https://wpsec.com/vuln/WPSEC-2026-2658/
• https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.4/
• https://wordpress.org/plugins/dokan-lite/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS