Description

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-21T07:16:24.637Z",
  "pubdate": "2026-08-21T07:16:24.637Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before version 5.0.14. The vulnerability stems from improper access control restrictions on a specific unauthenticated store REST endpoint.\nThis security flaw allows unauthenticated remote attackers to query sensitive business intelligence data, specifically the commission configuration associated with individual vendors. Depending on the targeted vendor's setup, exposed data includes the specific commission type, default commission rates, and per-category commission rates.\nThe risk implication involves unauthorized competitive intelligence gathering, as malicious actors can map out marketplace financial structures, vendor margins, and fee tiers without requiring any privileges or authentication. Exploitation requires network access to the target WordPress site's REST API endpoints.\nAffected systems are WordPress installations running the Dokan plugin prior to version 5.0.14. Remediation requires updating the plugin to the latest patched version.",
  "technicalDetails": "The vulnerability resides within the REST API endpoint handling store data within the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin. Specifically, the affected component fails to validate caller privileges or session state before returning per-vendor commission configurations.\nThe root cause is an access control flaw (Broken Access Control) where sensitive business logic configurations are exposed via unauthenticated store REST endpoints intended for public consumption. Rather than filtering internal financial metadata such as commission types and rates, the endpoint serializes and returns these parameters in the HTTP response.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies the target WordPress site running a vulnerable version of the Dokan plugin (prior to 5.0.14). Second, the attacker formulates an HTTP GET request targeting the unexposed store REST endpoint associated with a specific vendor ID. Third, the server processes the request without requiring authentication or authorization checks. Finally, the application returns a JSON payload containing the vendor's internal commission configurations, including commission types, default rates, and category-based commission structures.\nThe vulnerability requires network exposure via HTTP/HTTPS protocols targeting the WordPress REST API. No authentication or privilege requirements are necessary, enabling fully automated data harvesting scripts to enumerate commission structures across all registered vendors on the marketplace."
}