{
 "id": "WPSEC-2026-2658",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2658/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2658/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2658/index.md",
 "title": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.3.3 - Authenticated (Vendor+) Sensitive Information Exposure via Vendor Customers REST Endpoint",
 "description": "The Dokan plugin for WordPress is vulnerable to Sensitive Information Exposure via the dokan/v1/customers REST endpoint in versions 4.0.0 up to, and including, 5.3.3, due to the customer list query not being restricted to the requesting vendor's own customers. Until 5.0.3 all customers were returned; since then the returned rows are only filtered after the query runs, so the total and pagination headers and search matching still cover every customer. This makes it possible for authenticated attackers with vendor-level access to enumerate other registered customers and infer their details, such as email addresses, through search queries and the result count headers.",
 "plugin": {
  "slug": "dokan-lite",
  "name": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy",
  "full_name": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy",
  "wordpress_org": "https://wordpress.org/plugins/dokan-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/dokan-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/dokan-lite"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.0.0",
    "from_inclusive": true,
    "to": "5.3.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.0.0 before 5.3.4"
  ]
 },
 "introduced_in": "4.0.0",
 "fixed_in": "5.3.4",
 "remediation": "Update to 5.3.4 or later.",
 "fix_released": "2026-11-05T12:23:09+00:00",
 "published": "2026-11-06T12:43:54+00:00",
 "updated": "2026-11-06T12:02:00.274899+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2658/",
  "https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.4/",
  "https://wordpress.org/plugins/dokan-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/dokan-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-06"
 }
}