wedevs Dokan Pro Plugin up to 5.0.4 on WordPress Vendor Staff update_capabilities privileges management

Summaryinfo

A vulnerability, which was classified as critical, was found in wedevs Dokan Pro Plugin up to 5.0.4 on WordPress. The impacted element is the function update_capabilities of the component Vendor Staff Module. The manipulation results in privileges management. This vulnerability is identified as CVE-2026-12224. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in wedevs Dokan Pro Plugin up to 5.0.4 on WordPress. Affected is the function update_capabilities of the component Vendor Staff Module. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the `update_capabilities()` REST handler accepting arbitrary capability strings from the request body and passing them directly to WP_User::add_cap() with no allowlist validation, only verifying that the caller holds the dokandar capability. This makes it possible for authenticated attackers with a self-provisioned Vendor-level access and above, on sites with the Vendor Staff module enabled, to grant arbitrary WordPress capabilities, including administrator, to any vendor_staff account, leading to a full site takeover.

The weakness was released by 0xd4rk5id3. The advisory is available at wordfence.com. This vulnerability is traded as CVE-2026-12224 since 06/14/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation needs additional levels of successful authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/01/2026). This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-40928). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• wedevs

Name

• Dokan Pro Plugin

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion