CVE-2026-107774 in Dokan Plugin
Summary
by MITRE • 11/05/2026
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution for WordPress, specifically in versions prior to 5.3.3, represents a significant email security flaw rooted in improper handling of sender identity during automated communications. The core technical issue lies in how the plugin constructs the SMTP headers when relaying messages through its store contact form functionality. Instead of adhering to established best practices that separate the envelope sender from the visible header sender, the software directly injects an unauthenticated user's supplied email address into the From header field of outgoing emails. This design choice bypasses standard authentication mechanisms and allows external actors to dictate the apparent origin of messages sent by the application server itself.
This architectural flaw enables a specific type of email spoofing attack where an attacker can forge the sender identity to appear as if it originates from within the organization's own domain infrastructure. By supplying their controlled email address in the contact form, which is then placed directly into the From header, the resulting message aligns with the site’s SPF and DKIM records because it is being sent by the legitimate mail server associated with that domain. Consequently, receiving systems such as corporate firewalls, spam filters, or individual user inboxes are likely to trust these messages based on their valid authentication signatures, despite the sender address being fraudulent from a human perspective. This effectively neutralizes many defensive measures designed to detect unauthorized outbound communications because the cryptographic validation passes successfully due to the server's legitimate status relative to its own domain keys and IP addresses.
The operational impact of this vulnerability is severe in terms of social engineering potential and brand reputation damage. Attackers can leverage this capability to send phishing emails, malware distribution attempts, or fraudulent requests that appear to come from trusted sources such as site administrators or official store contacts. Because the email appears authentic due to passing SPF and DKIM checks, recipients are more likely to engage with malicious content without suspicion. This undermines trust in digital communications facilitated by the platform and exposes both vendors and customers to sophisticated phishing campaigns. Furthermore, this behavior can lead to blacklisting of the hosting server's IP address if receiving mail servers detect high volumes of spoofed or suspicious traffic originating from their infrastructure, even though the authentication technically validates correctly against the domain policies.
From a classification perspective, this vulnerability aligns with CWE-290, which covers Authentication Bypass by Spoofing, as well as CWE-346 regarding the Origin of Untrusted Data. In terms of offensive security frameworks like MITRE ATT&CK, this technique is consistent with T1571, Non-Standard Port or Protocol usage for C2, and more specifically relates to email-based attacks under T1534, Internal Spearphishing, where attackers use compromised or spoofed internal identities to target users within the same organization. The ability to send messages that appear locally generated is a critical step in establishing trust before executing further malicious actions against high-value targets such as administrators or financial departments within e-commerce operations.
To mitigate this risk, immediate updates to version 5.3.3 or later are required for all installations of the Dokan plugin. The patch addresses the header construction logic by ensuring that untrusted user input is never placed directly in the From field. Instead, developers should implement a pattern where the envelope sender remains a system-controlled address while any user-provided contact information is relegated to the Reply-To header or included within the body text of the message. This separation ensures that authentication checks performed by receiving mail servers validate against the legitimate server identity rather than an attacker-supplied domain. Additionally, organizations should enforce strict DMARC policies with p=reject on their domains to prevent any future instances where spoofed emails might slip through filters if similar coding errors occur in other plugins or core WordPress functionality. Regular security audits of email handling code and adherence to RFC 5321 standards for mail transfer agents are essential preventive measures against this class of vulnerabilities.