WordPress Plugin Vulnerabilities

Dokan < 5.0.3 - Customer+ Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation, allowing authenticated attackers with Customer-level access and above to elevate their privileges.

Affects Plugins

Plugin icon
dokan-lite
Fixed in 5.0.3

References

CVE
CVE-2026-49780
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b142859d-780f-47f8-aaed-000bdd0aaaa7

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Nguyen Ba Khanh
Verified
Yes
WPVDB ID
b94ec475-2f1c-46c6-82c2-93123109d9d2

Timeline

Publicly Published
2026-06-03 (about 1 month ago)
Added
2026-06-11 (about 1 month ago)
Last Updated
2026-07-24 (about 1 day ago)

Other

Published
Title
Published
2026-07-03
Title
ProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selection
Published
2025-04-30
Title
SureTriggers < 1.0.83 - Unauthenticated Privilege Escalation
Published
2023-08-21
Title
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
Published
2026-07-10
Title
Essential Addons for Elementor < 6.6.11 - Contributor+ Account Takeover via Email Header Injection
Published
2025-03-13
Title
Industrial < 1.7.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update