Access Control Flaw in Dokan WooCommerce Marketplace Solution
CVE-2026-16574
What is CVE-2026-16574?
The Dokan plugin for WooCommerce, version prior to 5.0.11, has a significant access control vulnerability. It fails to adequately verify that a downloadable product is associated with the requesting vendor, exposing a risk where an authenticated vendor could inadvertently grant their customers unauthorized free access to paid downloadable products belonging to other vendors through the order REST endpoints. This security flaw highlights the necessity for robust verification checks to maintain the integrity of downloadable product access within multi-vendor marketplace frameworks.
Affected Version(s)
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution 0 < 5.0.11
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.