CVE-2026-16576 in Dokan Plugin
Summary
by MITRE • 08/21/2026
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution for WordPress prior to version 5.0.14 represents a critical authorization flaw within its administrative REST API endpoints. This issue stems from an improper implementation of access control mechanisms, specifically where the plugin fails to enforce strict capability checks required for sensitive operations. Instead of verifying that the requesting user possesses the specific Dokan installation capability necessary to manage core marketplace functionalities, the code relies on a broader WooCommerce management capability. In WordPress architecture, this distinction is vital because it separates general store administration from privileged actions such as installing or updating plugins and themes, which can significantly alter the application's behavior and security posture.
From a technical perspective, the flaw allows users with lower privilege levels, specifically Shop Managers, to bypass intended restrictions and execute administrative functions reserved for higher-privileged roles like Administrators. By exploiting this misconfiguration, an authenticated attacker who has been granted Shop Manager status on any vendor store within the multivendor marketplace can interact directly with the plugin's REST API endpoints designed for installation tasks. The system incorrectly validates these requests against WooCommerce capabilities rather than Dokan-specific permissions, effectively treating a shop manager as if they had full administrative control over the WordPress environment regarding plugin management. This discrepancy creates an unauthorized path to execute code that should be strictly gated by higher-level security protocols.
The operational impact of this vulnerability is severe due to its potential for remote code execution and complete system compromise. Since Shop Managers can install arbitrary plugins from the official WordPress repository, they have the ability to upload and activate malicious software disguised as legitimate marketplace extensions or unrelated tools. Once activated, these malicious plugins can execute PHP code with the same privileges as the web server process running WordPress. This grants the attacker full control over the website's backend, enabling them to exfiltrate sensitive customer data including credit card information, personal identifiable information, and administrative credentials stored in the database. Furthermore, attackers can use this access to deface the site, inject backdoors for persistent access, or pivot into other systems within the organization if the server is part of a larger network infrastructure.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as it involves granting users more permissions than they should possess based on their role. Additionally, from an offensive security standpoint such as the MITRE ATT&CK framework, this flaw facilitates techniques related to Initial Access and Persistence through malicious plugin installation. The ability for lower-privileged accounts to install arbitrary code is a classic example of how weak authorization checks can lead to full system compromise in web applications that rely on role-based access control models.
To mitigate this risk, administrators must immediately upgrade the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin to version 5.0.14 or later, where these capability checks have been corrected to properly enforce separation of duties between Shop Managers and Administrators. In environments where upgrading is not instantly feasible, temporary mitigations include restricting access to WordPress admin endpoints via IP whitelisting for administrative users only and ensuring that no untrusted individuals are assigned the Shop Manager role unless absolutely necessary with strict monitoring enabled. Regular auditing of user roles and capabilities within both WooCommerce and Dokan settings should be conducted to ensure alignment with security best practices, preventing unauthorized privilege escalation through similar vectors in other plugins or core WordPress functionalities.