CVE-2026-8761: Dokan Plugin Missing Authorization Privilege Escalation

Vulnerability Overview Vulnerability Name: Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation CVE ID: CVE-2026-8761 CVSS Score: 8.8 (High) Published Date: April 4, 2026 Last Updated: August 5, 2026 Researcher: ka63001 Affected Versions Affected Versions: <= 5.0.2 Software Type: Plugin Software Name: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy Remediation Fixed Version: 5.0.3 Recommendation: Update to version 5.0.3 or later Vulnerability Description The Dokan plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to 5.0.1. This issue stems from a missing authorization check in the REST controller ( ). The controller re-registers WooCommerce’s customer CRUD routes and replaces WooCommerce’s native capability check with a vendor-specific role validation for both the requesting user and the targeting user. This allows attackers with vendor/seller-level access to read, modify, or delete any WordPress user account, including administrators, by sending / / requests to . Setting the parameter in the administrator record enables complete site takeover. Reference Links plugins.trac.wordpress.org Additional Information Share Options: Facebook, Twitter, LinkedIn, Email Recent Vulnerabilities List Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy - CVE-2026-66699: 5.0.10 - Missing Authorization - CVE-2026-57706: 5.0.6 - Unauthenticated Stored Cross-Site Scripting - CVE-2026-11987: 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via id Parameter - CVE-2026-11783: 5.0.4 - Authenticated (Customer) Stored Cross-Site Scripting via Product SKU - CVE-2026-10023: 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers - CVE-2026-49780: 5.0.2 - Authenticated (Customer+) Privilege Escalation - CVE-2026-3504: 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint - CVE-2026-24359: 4.2.4 - Missing Authorization - CVE-2025-14977: 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure - CVE-2025-53425: 4.1.3 - Authenticated (Shop Manager+) Privilege Escalation Copyright Information Copyright: 2012-2026 Defiant Inc. License: Defiant Inc. grants a perpetual, worldwide, non-exclusive, free, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly display, publicly perform, distribute, and otherwise communicate this software vulnerability information. Contact Information Contact Email: wfi-support@wordfence.com Additional Resources Wordfence Intelligence: Offers free personal and commercial API access, as well as free webhook integration, for the latest vulnerability information. Wordfence WordPress Plugin: Install the Wordfence plugin to be notified immediately if you are affected by any vulnerability. Footer Information Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Links Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram Product Links Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Support Links Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support News Links Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories About Links About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Subscription Links Sign up for news and updates: Sign up for news and updates Disclaimer Disclaimer: Disclaimer Copyright Year Copyright Year: 2012-2026 Other Information Other Information: Other Information Summary This page primarily details a privilege escalation vulnerability in the Dokan plugin, affecting versions <= 5.0.2, and provides remediation steps and reference links. The page also lists several recently discovered vulnerabilities and offers information on Wordfence Intelligence and contact details.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-8761: Dokan Plugin Missing Authorization Privilege Escalation

More from this source