WordPress Plugin Vulnerabilities

Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint

Description

The plugin does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.

Proof of Concept

Affects Plugins

Plugin icon
dokan-lite
Fixed in 5.3.3

References

CVE
CVE-2026-107773

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Md Mehedi Hasan
Submitter
Md Mehedi Hasan
Submitter website
https://mdhasan.me
Verified
Yes
WPVDB ID
7ef1f47f-60d2-41f0-afca-584752503fae

Timeline

Publicly Published
2026-11-03 (about 2 days ago)
Added
2026-11-03 (about 1 day ago)
Last Updated
2026-11-03 (about 1 day ago)

Other

Published
Title
Published
2026-10-15
Title
WSP MCP < 2.9.6 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool
Published
2025-11-14
Title
Image Gallery – Photo Grid & Video Gallery < 2.12.29 - Author+ Arbitrary Image File Move
Published
2023-06-05
Title
Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution
Published
2026-10-21
Title
Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route
Published
2022-07-25
Title
Flipbox < 2.6.1 - Authenticated Arbitrary Options Update