Insecure Direct Object Reference Vulnerability in Dokan Plugin for WordPress

CVE-2026-89280

What is CVE-2026-89280?

The Dokan Multivendor Marketplace Solution for WordPress is susceptible to an Insecure Direct Object Reference vulnerability due to inadequate validation of the 'password' parameter. Authenticated users with vendor-level access can exploit this issue to change the passwords of customers who have previously placed orders with their store. This enables the attacker to log in as that customer, resulting in limited account takeover. The vulnerability affects all versions of Dokan Lite up to 5.2.1 and can be exploited by users who self-register as vendors through the site's vendor registration flow, emphasizing the need for meticulous access controls.

References