Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.3.3 - Unauthenticated Sensitive Information Exposure via Spoofed MCP Request URI
- ID
- WPSEC-2026-2659
- Plugin
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (dokan-lite)
- Affected
- from 5.0.15 before 5.3.4
- Remediation
- Update to 5.3.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-06
- Attack surface
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy on WPSec AttackSurface
- Fix released
- Published
Description
The Dokan plugin for WordPress is vulnerable to Sensitive Information Exposure via the WooCommerce products REST API in versions 5.0.15 up to, and including, 5.3.3, due to the MCP/ability context being detected from the attacker-controlled raw request URI instead of the dispatched REST route, combined with the product ability scope granting single-product read permission for any published product without requiring an authenticated user. This makes it possible for unauthenticated attackers to read the full WooCommerce REST representation of published products, including fields not shown on the storefront such as custom meta data, purchase notes and the content of password-protected products, by sending a product REST request whose URI contains an MCP path segment, for example in the query string.
References
- https://wpsec.com/vuln/WPSEC-2026-2659/
- https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.4/
- https://wordpress.org/plugins/dokan-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS