WordPress Plugin Vulnerabilities
Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coupon
Description
The plugin does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.
Proof of Concept
Affects Plugins
References
CVE
Miscellaneous
Original Researcher
Sanjeev Kumar
Submitter
Sanjeev Kumar
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-11-03 (about 2 days ago)
Added
2026-11-03 (about 1 day ago)
Last Updated
2026-11-03 (about 1 day ago)