Description

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-21T07:16:24.740Z",
  "pubdate": "2026-08-21T07:16:24.740Z",
  "executiveSummary": "An improper authorization vulnerability exists in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14.\nThe flaw resides within specific admin REST API routes, which fail to enforce correct user capability checks.\nInstead of validating the required Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, the endpoints only verify a generic WooCommerce management capability.\nThis authorization bypass allows low-privileged administrative users, such as Shop Managers, to unauthorizedly install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from the official WordPress.org repository.\nThe risk implication involves unauthorized software installation and potential privilege escalation through plugin activation.\nExploitation requires authenticated access with specific low-level administrative privileges, such as a Shop Manager role, targeting the exposed administrative REST API routes.",
  "technicalDetails": "The vulnerability stems from improper access control enforcement within the administrative REST API route handlers of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14.\nThe root cause is an insufficient capability check during API request processing, where developers relied on a broader WooCommerce management capability rather than enforcing the granular installation capability specific to the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14.\nThe affected components are the administrative REST API endpoints responsible for querying, downloading, installing, and activating plugins from WordPress.org.\nThe affected product versions include all instances of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14.\nExploitation requires network exposure to the WordPress REST API and authentication with restricted administrative privileges, specifically a role like Shop Manager.\nThe attack flow proceeds as follows: First, an authenticated attacker with Shop Manager privileges crafts an HTTP POST or relevant REST API request directed at the vulnerable administrative endpoint. Second, the backend REST API controller processes the request, invoking the flawed capability check function. Third, because the user possesses the generic WooCommerce management capability, the validation check incorrectly passes, bypassing the intended security restriction. Fourth, the application processes the parameters to install and activate an arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 sourced from WordPress.org.\nThe post-exploitation impact includes unauthorized plugin provisioning and potential execution of arbitrary code if the newly installed and activated extensions contain further vulnerabilities or malicious capabilities."
}