CVE-2026-16565 in Dokan Plugin
Summary
by MITRE • 08/03/2026
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor's products on the marketplace.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability exists within the Dokan WordPress plugin version 5.0.8 and earlier, which serves as an AI-powered marketplace solution for WooCommerce multivendor environments. This security flaw specifically targets the REST API endpoints responsible for managing product attributes and default attributes within the marketplace ecosystem. The issue stems from insufficient access control verification mechanisms that fail to validate whether a requesting vendor account has legitimate ownership rights over the target product before permitting attribute modifications. This represents a critical authorization bypass vulnerability that undermines the fundamental security model of the multivendor marketplace.
The technical implementation flaw manifests in the REST write endpoints for product attributes where the plugin fails to perform proper ownership validation checks. When a Dokan vendor account makes a request to modify product attributes through the API, the system does not cross-reference the requesting user's vendor credentials against the actual product owner in the database. This absence of verification creates an arbitrary write condition where any authenticated vendor can manipulate the metadata and attribute configurations of products belonging to other vendors within the same marketplace. The vulnerability specifically affects both regular product attributes and default attributes, potentially allowing attackers to alter critical product information that impacts search functionality, filtering capabilities, and overall marketplace integrity.
The operational impact of this vulnerability extends beyond simple data manipulation to encompass potential marketplace disruption and competitive disadvantage. An attacker with a vendor account could modify another vendor's product attributes to include misleading information, alter pricing-related attribute values, or manipulate categorization data that affects product visibility in search results. This capability could be exploited to degrade competitor listings, introduce malicious attribute values that might trigger security alerts, or fundamentally alter the marketplace's product presentation and user experience. The vulnerability essentially allows unauthorized modification of product metadata across the entire marketplace without proper authorization boundaries, creating a significant risk for both individual vendors and the marketplace platform as a whole.
This vulnerability maps directly to CWE-284 (Improper Access Control) within the Common Weakness Enumeration framework, specifically addressing insufficient access control mechanisms in REST API endpoints. The issue also aligns with ATT&CK technique T1078.004 (Valid Accounts: Cloud Accounts) as it exploits legitimate vendor accounts to perform unauthorized actions. From a security perspective, this represents a privilege escalation scenario where the attacker leverages their existing vendor account privileges to access and modify resources beyond their intended scope. The risk is amplified in marketplace environments where multiple vendors operate with varying levels of trust and where product integrity directly impacts consumer confidence and platform reputation. Organizations should implement immediate mitigations including patching to version 5.0.9 or later, implementing additional API rate limiting, and establishing more robust access control validation mechanisms at the REST endpoint level.
The remediation strategy requires deployment of the patched version 5.0.9 which addresses the core ownership verification flaw in the product attribute modification endpoints. Additionally, administrators should implement comprehensive monitoring of attribute modification activities through audit logging to detect unauthorized changes even if the immediate fix is not yet deployed. Security teams should also consider implementing network-level access controls that limit direct API access to trusted administrative systems and establish automated alerting for suspicious attribute modification patterns across multiple vendors. The vulnerability highlights the critical importance of proper authorization validation in distributed marketplace platforms where multiple user roles interact with shared resources, emphasizing that security controls must be implemented at every layer of the application architecture to prevent such cross-user data manipulation scenarios.