WordPress Plugin Vulnerabilities

Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API

Description

The plugin does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the plugin-installation capability, allowing users such as Shop Managers to install and activate arbitrary plugins from WordPress.org.

Proof of Concept

Affects Plugins

Plugin icon
dokan-lite
Fixed in 5.0.14

References

CVE
CVE-2026-16576

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Khaled Alenazi (Nxploited)
Submitter
Khaled Alenazi (Nxploited)
Submitter website
https://github.com/Nxploited/
Verified
Yes
WPVDB ID
801e9008-e912-4606-8c21-3d31dc0bd2c7

Timeline

Publicly Published
2026-08-19 (about 23 days ago)
Added
2026-08-19 (about 22 days ago)
Last Updated
2026-08-19 (about 22 days ago)

Other

Published
Title
Published
2021-04-06
Title
WPBakery Page Builder Clipboard < 4.5.8 - Unauthorised Arbitrary License Options Update
Published
2024-05-21
Title
AI ChatBot < 5.3.6 - Missing Authorization via openai_file_list_callback
Published
2022-06-28
Title
Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update
Published
2026-02-25
Title
User Registration & Membership < 5.1.3 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
Published
2026-07-06
Title
WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key