8.8

CVE-2026-8761: dokaninc dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsy Missing Authorization

CVSS: 8.8v3.1HighDeferred
Published 05-08-2026Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2026-8761 is a high (CVSS 8.8) Missing Authorization vulnerability in dokaninc dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsy. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.1% of scored vulnerabilities. Fixed in 5.0.3.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.69%
0%100%
Low · +0.33 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 05-08-2026
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the `CustomersController` REST controller (`includes/REST/CustomersController.php`), which re-registers WooCommerce's customer CRUD routes under the `/dokan/v1/customers/` namespace and replaces WooCommerce's native `manage_woocommerce` capability check with a vendor-only check that inspects the **requesting** user's role and never validates the **target** user. This makes it possible for authenticated attackers with Vendor/Seller-level access and above to read, modify, or delete any WordPress user — including administrators — via `GET`/`PUT`/`DELETE` requests against `/wp-json/dokan/v1/customers/{id}`. Setting the `password` parameter on an administrator's record yields a full site takeover.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.69%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

+0.33 pp

From 0.36% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.69%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Dokaninc1 product
  • dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsy≤ 5.0.2
Wordpress1 product
  • dokan-lite≤ 5.0.2 (fixed in 5.0.3)

2 vendors · 2 products

References

11 links
Show all 11 references