WordPress Plugin Vulnerabilities

Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

Description

The plugin does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor's products on the marketplace.

Proof of Concept

Affects Plugins

Plugin icon
dokan-lite
Fixed in 5.0.9

References

CVE
CVE-2026-16565

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Sai Praneeth Koti
Submitter
Sai Praneeth Koti
Verified
Yes
WPVDB ID
82c341bb-64ad-45ee-9ac7-8d99927f0c0a

Timeline

Publicly Published
2026-07-24 (about 10 days ago)
Added
2026-07-24 (about 9 days ago)
Last Updated
2026-07-24 (about 9 days ago)

Other

Published
Title
Published
2025-12-11
Title
Campay Woocommerce Payment Gateway < 1.2.3 - Unauthenticated Payment Bypass
Published
2026-01-01
Title
Fiorello <= 1.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2024-12-03
Title
LA-Studio Element Kit for Elementor < 1.4.5 - Authenticated (Contributor+) Post Disclosure
Published
2026-02-02
Title
Tutor LMS < 3.9.6 - Instructor+ Arbitrary Course Modification and Deletion via IDOR
Published
2024-01-04
Title
Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post Disclosure