Authorization Flaw in Dokan Multivendor Marketplace Solution for WordPress
CVE-2026-107775
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 November 2026
Badges
What is CVE-2026-107775?
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution for WordPress contains a significant authorization flaw that permits an unauthorized subsite administrator on a WordPress Multisite network to grant marketplace seller status to users across different subsites. This vulnerability arises because the plugin fails to verify whether the acting administrator has the necessary permissions to manage users outside their own site. As a result, a subsite administrator can mistakenly or maliciously assign selling capabilities to network-level users, leading to unauthorized access and potential misuse of the marketplace functionalities.
Affected Version(s)
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution 0 < 5.3.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.