Description

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal ledger with an arbitrary amount and clear their real commission debt without paying.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-21T07:16:24.840Z",
  "pubdate": "2026-08-21T07:16:24.840Z",
  "executiveSummary": "An improper validation vulnerability exists in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14.\nThe vulnerability allows authenticated vendor users to supply an arbitrary payment amount when recording a reverse-withdrawal payment, bypassing validation against their actual outstanding balance.\nSuccessful exploitation enables a malicious vendor to artificially credit their reverse-withdrawal ledger with arbitrary values and completely clear their real commission debt without performing actual payments.\nThis flaw directly impacts financial integrity within multi-vendor marketplace deployments, posing severe business logic and financial risks.\nThe attack requires vendor-level access to the platform and can be executed over standard network protocols by manipulating the client-supplied payment amount parameter during the reverse-withdrawal transaction recording process.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of server-side validation and sanitization regarding the client-supplied payment amount parameter within the reverse-withdrawal payment recording functionality of the Dokan plugin.\nWhen a vendor initiates or records a reverse-withdrawal payment to settle their commission debt, the application fails to cross-reference the submitted transaction amount against the vendor's actual outstanding balance stored in the database.\nAffected versions include all Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.0.14.\nThe attack flow proceeds as follows: First, a malicious actor authenticates as a vendor with standard privileges on the WordPress site. Second, the vendor navigates to the reverse-withdrawal or commission debt settlement interface. Third, the vendor submits a crafted HTTP request containing an arbitrarily high payment amount intended to clear their ledger. Fourth, the vulnerable backend handler accepts the client-supplied payment value without verifying it against the legitimate outstanding balance. Finally, the application updates the vendor's reverse-withdrawal ledger and clears their real commission debt.\nPost-exploitation impact includes unauthorized financial ledger manipulation, financial loss for marketplace operators, and circumvention of mandatory debt settlement processes without transferring actual funds."
}