WordPress Plugin Vulnerabilities

Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coupon

Description

The plugin does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.

Proof of Concept

Affects Plugins

Fixed in 5.3.3

References

Miscellaneous

Original Researcher
Sanjeev Kumar
Submitter
Sanjeev Kumar
Verified
Yes

Timeline

Publicly Published
2026-11-03 (about 2 days ago)
Added
2026-11-03 (about 1 day ago)
Last Updated
2026-11-03 (about 1 day ago)

Other