Dokan WooCommerce Marketplace: IDOR enables account takeover via password
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Dokan, a WooCommerce multivendor marketplace plugin for WordPress, contains an Insecure Direct Object Reference (CWE-639) in all versions through 5.2.1. Missing validation of a user-controlled key in the 'password' parameter lets an authenticated attacker with custom-level access change the WordPress password of any customer who has placed at least one order with the attacking vendor. The attacker can then log in as that customer, a limited account takeover. Exploitation requires vendor-level access, which anyone can self-register through the public 'I am a vendor' flow when that option is enabled.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to change the WordPress account password of any customer who has placed at least one order with the attacking vendor, enabling login as that customer and resulting in a limited account takeover. Vendor-level access, required to exploit this vulnerability, can be self-registered through the public 'I am a vendor' registration flow when that option is enabled on the site.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| dokaninc | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | up to 5.2.1 | — | No fix listed | CNA |
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy Vendordokaninc Affected up to 5.2.1 Fixed in — No fix listed CNA
Remediation
No fixed version is listed for Dokan 5.2.1 and earlier. Disable the 'I am a vendor' registration option to stop self-registered vendor accounts, and review customer password changes made through /wp-json/dokan/v1/customers/{id}. Install a Dokan release later than 5.2.1 once the vendor publishes one.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-89280
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Alias added: GHSA-ff3p-97v2-hvmp
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa56b6b-508f-44d8-a81c-2b84cebd245b?source=cve
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L227
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L60
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L99
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L352
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/Order/functions.php#L858
- https://github.com/getdokan/dokan/pull/3433/changes
- https://plugins.trac.wordpress.org/changeset/3734440/dokan-lite/trunk/includes/REST/CustomersController.php
More dokaninc vulnerabilities
- TI-2026-07700 Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation CVSS 3.1HIGH 8.8
- TI-2025-13661 Improper access control in dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace… CVSS 3.1HIGH 8.1
- TI-2026-03019 Information disclosure in dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace… CVSS 3.1MEDIUM 5.3
- TI-2026-10170 Cross-site scripting in dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace… CVSS 3.1MEDIUM 6.4
- TI-2026-10330 Authorization bypass in dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace… CVSS 3.1MEDIUM 4.3
- TI-2026-08784 Authorization bypass in dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace… CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-89280 · CVE Program
- CVE-2026-89280 · NVD
- FIRST EPSS
- GHSA-ff3p-97v2-hvmp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences