Insecure Direct Object Reference in Dokan WooCommerce Plugin for WordPress

CVE-2025-14977

What is CVE-2025-14977?

The Dokan WooCommerce plugin for WordPress exposes a significant security flaw allowing authenticated users with customer-level permissions or higher to exploit the /wp-json/dokan/v1/settings REST API endpoint. Due to inadequate validation of user-controlled keys, attackers could access and alter sensitive settings of other vendors, including payment details like PayPal emails, bank account information, and personal identifiers. This vulnerability poses a serious risk as it enables the unauthorized modification of vendor data, potentially facilitating financial theft during marketplace transaction processes.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References