CVE-2026-8761

Name of the Vulnerable Software and Affected Versions Dokan versions prior to 5.0.2

Description A privilege escalation issue exists due to a missing authorization check in the CustomersController REST controller located in includes/REST/CustomersController.php. The plugin re-registers WooCommerce customer CRUD routes under the /dokan/v1/customers/ namespace and replaces the standard manage woocommerce capability check with a check that only verifies the role of the requesting user without validating the target user. Consequently, authenticated users with Vendor or Seller roles can read, modify, or delete any WordPress user, including administrators, by sending GET, PUT, or DELETE requests to the /wp-json/dokan/v1/customers/{id} endpoint. Specifically, modifying the password parameter of an administrator account can lead to a full site takeover.

Recommendations Update to a version newer than 5.0.1. Restrict access to the /wp-json/dokan/v1/customers/{id} endpoint to minimize the risk of exploitation.