# Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.3.3 - Authenticated (Vendor+) Sensitive Information Exposure via Vendor Customers REST Endpoint

- **ID:** WPSEC-2026-2658
- **Plugin:** Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (`dokan-lite`), https://wordpress.org/plugins/dokan-lite/
- **Affected versions:** from 4.0.0 before 5.3.4
- **Fixed in:** 5.3.4 (Update to 5.3.4 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/dokan-lite
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2658/

## Description

The Dokan plugin for WordPress is vulnerable to Sensitive Information Exposure via the dokan/v1/customers REST endpoint in versions 4.0.0 up to, and including, 5.3.3, due to the customer list query not being restricted to the requesting vendor's own customers. Until 5.0.3 all customers were returned; since then the returned rows are only filtered after the query runs, so the total and pagination headers and search matching still cover every customer. This makes it possible for authenticated attackers with vendor-level access to enumerate other registered customers and infer their details, such as email addresses, through search queries and the result count headers.

## References

- https://wpsec.com/vuln/WPSEC-2026-2658/
- https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.4/
- https://wordpress.org/plugins/dokan-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2658/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.