Privilege Escalation Vulnerability in Dokan Plugin for WordPress
CVE-2026-8761

8.8HIGH

Key Information:

Vendor

WordPress
Status
Dokan: Ai Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, Ebay, Etsy
Vendor
CVE Published:
5 August 2026

What is CVE-2026-8761?

The Dokan plugin for WordPress allows authenticated attackers with Vendor/Seller-level access to perform unauthorized actions, such as reading, modifying, or deleting any WordPress user, including administrators. This vulnerability arises from a missing authorization check within the CustomersController REST controller, which neglects to validate the target user's role. Consequently, attackers can exploit this weakness to execute GET, PUT, and DELETE requests against the customers' endpoint, leading to severe security implications, including potential full site takeovers.

Affected Version(s)

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <=5.0.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/dokan-lite/tag...
https://plugins.trac.wordpress.org/browser/dokan-lite/tru...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kai63001
.