WordPress Plugin Vulnerabilities

Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation

Description

The plugin does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.

Proof of Concept

Affects Plugins

Fixed in 5.3.3

References

Classification

Type
INCORRECT AUTHORISATION
CWE

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes

Timeline

Publicly Published
2026-11-03 (about 2 days ago)
Added
2026-11-03 (about 1 day ago)
Last Updated
2026-11-03 (about 1 day ago)

Other