Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint
Priority LOW 24CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-639.
Summary
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Dokan: AI Powered WooCommerce Multivendor Marketplace Solution (Unknown): 5.0.11
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution | before 5.0.11 | 5.0.11 | Patch available | CNA |
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution VendorUnknown Affected before 5.0.11 Fixed in 5.0.11 Patch available CNA
Remediation
- Fix · CNA Dokan: AI Powered WooCommerce Multivendor Marketplace Solution (Unknown) Fixed in 5.0.11
Timeline
- 2026-10-02 Threatist record created from CVE-2026-16574
- 2026-10-03 Alias added: GHSA-9qg2-vxvm-6fvv
References
Sources
- CVE-2026-16574 · CVE Program
- CVE-2026-16574 · NVD
- FIRST EPSS
- GHSA-9qg2-vxvm-6fvv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences