CVE-2026-16574 in Dokan Plugin
Summary
by MITRE • 08/08/2026
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/08/2026
This vulnerability exists within the Dokan WordPress plugin version 5.0.10 and earlier, which implements an AI-powered multivendor marketplace solution for WooCommerce platforms. The flaw manifests in the plugin's order REST endpoints where proper access control verification is missing, creating a critical authorization bypass that allows authenticated vendors to exploit the system's download permissions mechanism. The vulnerability stems from insufficient validation logic that fails to cross-check whether downloadable products are legitimately associated with the requesting vendor account before granting download access. This represents a direct violation of the principle of least privilege and proper access control enforcement.
The technical implementation flaw specifically occurs in the REST API endpoint handling for downloadable product access within the Dokan plugin architecture. When an authenticated vendor makes a request to download a product through the order REST endpoints, the system does not perform a vendor-product ownership verification check. This allows any authorized vendor to manipulate the download request parameters to access products belonging to other vendors, effectively bypassing the intended access control mechanisms. The vulnerability is categorized under CWE-285: Improper Authorization, which directly relates to systems that fail to properly verify user permissions before granting access to protected resources.
The operational impact of this vulnerability is severe for marketplace operators and individual vendors who rely on the platform's security controls. An authenticated vendor could potentially download and distribute another vendor's paid products without payment, leading to direct revenue loss and intellectual property theft. The exploitation creates a persistent threat where malicious vendors could systematically access competitors' premium content, undermining the marketplace's commercial integrity and vendor trust. This vulnerability particularly affects e-commerce environments where vendors sell digital goods and expect proper protection of their downloadable content.
Mitigation strategies should focus on implementing robust input validation and access control checks within the REST API endpoints. The plugin must enforce strict vendor-product ownership verification before granting download permissions, using database queries to confirm that requested products belong to the authenticated vendor account. Security patches should include comprehensive permission checking mechanisms that validate both user authentication status and product ownership relationships. Organizations should also implement proper logging of download requests to detect unauthorized access attempts and establish monitoring procedures for suspicious activity patterns that could indicate exploitation attempts.
This vulnerability aligns with several ATT&CK techniques including T1078 Valid Accounts for maintaining persistence through legitimate vendor accounts and T1566 Phishing for initial compromise. The attack surface is particularly concerning in multi-tenant environments where multiple vendors share the same platform, as it creates opportunities for data exfiltration and commercial espionage. Organizations should also consider implementing network-level monitoring to detect unusual download patterns that could indicate exploitation of this vulnerability across their marketplace infrastructure.