CVE-2026-16576: unknown dokan: ai powered woocommerce multivendor marketplace solution Code Injection

Vulnerability summary

CVE-2026-16576 is a high (CVSS 7.2) Code Injection vulnerability in unknown dokan: ai powered woocommerce multivendor marketplace solution. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.3% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 5.0.14.

Timeline

1. 21-08-2026
   PublishedVulnerability first disclosed.
2. 21-08-2026
   Last modifiedVulnerability information updated.

Description

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.