# Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.3.3 - Unauthenticated Sensitive Information Exposure via Spoofed MCP Request URI

- **ID:** WPSEC-2026-2659
- **Plugin:** Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (`dokan-lite`), https://wordpress.org/plugins/dokan-lite/
- **Affected versions:** from 5.0.15 before 5.3.4
- **Fixed in:** 5.3.4 (Update to 5.3.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/dokan-lite
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2659/

## Description

The Dokan plugin for WordPress is vulnerable to Sensitive Information Exposure via the WooCommerce products REST API in versions 5.0.15 up to, and including, 5.3.3, due to the MCP/ability context being detected from the attacker-controlled raw request URI instead of the dispatched REST route, combined with the product ability scope granting single-product read permission for any published product without requiring an authenticated user. This makes it possible for unauthenticated attackers to read the full WooCommerce REST representation of published products, including fields not shown on the storefront such as custom meta data, purchase notes and the content of password-protected products, by sending a product REST request whose URI contains an MCP path segment, for example in the query string.

## References

- https://wpsec.com/vuln/WPSEC-2026-2659/
- https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.4/
- https://wordpress.org/plugins/dokan-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2659/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.