Sensitive Information Exposure in Dokan Plugin for WordPress Multivendor Marketplace

CVE-2026-3504

What is CVE-2026-3504?

The Dokan plugin for WordPress enables potential unauthorized access to sensitive information. In versions up to 4.3.1, the '/dokan/v1/stores/{id}/reviews' REST API endpoint leaks email addresses, usernames, and user IDs of customers who have left reviews. This vulnerability arises from the improper inclusion of reviewer information in API responses. Attackers, even without authentication, can capitalize on this flaw, potentially compromising the personal data of all customers engaged with vendor stores. To be vulnerable, the Pro version of the plugin needs to be activated with store reviews enabled.

References