Email Spoofing Vulnerability in Dokan WooCommerce Plugin from Vendor WordPress
CVE-2026-107774
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 November 2026
Badges
What is CVE-2026-107774?
The Dokan plugin for WooCommerce, prior to version 5.3.3, contains a vulnerability that allows unauthenticated attackers to manipulate the sender address in emails sent through the store's contact form. Instead of using a trusted site-owned sender address, the plugin directly includes the submitter's address in the message's From header. This flaw can potentially allow attackers to send emails that appear to come from legitimate accounts associated with the site, contributing to phishing and other malicious activities aimed at the vendor or site users.
Affected Version(s)
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution 0 < 5.3.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.