Improper Reconciliation in Dokan WordPress Plugin by Harish Chandra
CVE-2026-107776

2.2LOW

Key Information:

Vendor

WordPress
Status
Dokan
Vendor
CVE Published:
5 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-107776?

A flaw in the Dokan WordPress plugin prior to version 5.3.3 allows vendors to manipulate payment reconciliation processes. The plugin does not properly match the credited amounts in a vendor's reverse-withdrawal ledger to the actual payments received for orders. This oversight enables vendors to reduce their commission debts by leveraging discount coupons while still not fully paying their owed amount. As a result, this vulnerability poses a risk to the integrity of financial transactions within the platform.

Affected Version(s)

Dokan 0 < 5.3.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-107776 - Proof of Concept

References

https://wpscan.com/vulnerability/e34bdc0e-0e33-4ffd-8edb-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
2.2
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sanjeev Kumar
WPScan
.