CVE-2026-16564

Name of the Vulnerable Software and Affected Versions Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.0.9

Description The plugin fails to verify order ownership on the 'orders/bulk-actions' REST endpoint. This allows users with a vendor account to modify the status of any WooCommerce order within the marketplace, including those belonging to other vendors or the store's customers.

Recommendations Update the plugin to version 5.0.9 or later. As a temporary mitigation, restrict access to the 'orders/bulk-actions' REST endpoint for vendor accounts.