Privilege Escalation Vulnerability in Dokan Pro Plugin for WordPress

CVE-2025-5931

What is CVE-2025-5931?

The Dokan Pro plugin for WordPress contains a vulnerability that allows privileged accounts to escalate their access levels. This occurs due to insufficient validation of user identity during the password reset process. Consequently, authenticated users with vendor-level access can exploit this weakness to elevate their privileges to that of a staff member, enabling them to change passwords for any user, including administrators. This loophole compromises account security and can lead to unauthorized access across all accounts within the platform.

References