CVE-2026-12224

Name of the Vulnerable Software and Affected Versions Dokan Pro versions prior to 5.0.5

Description The plugin contains a privilege escalation flaw within the 'update capabilities' REST endpoint. The update capabilities() REST handler fails to implement allowlist validation when processing capability strings from the request body, passing them directly to the WP User::add cap() function. This allows authenticated attackers with Vendor-level access or higher, on sites where the Vendor Staff module is active, to assign arbitrary WordPress capabilities, such as administrator privileges, to any vendor staff account, potentially resulting in a complete site takeover.

Recommendations Update to version 5.0.5 or later. Restrict access to the 'update capabilities' REST endpoint to minimize the risk of exploitation.