PT-2026-79302

CVE-2026-16576

Published

2026-08-21

Updated

2026-08-28

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dokan: AI Powered WooCommerce Multivendor Marketplace Solution versions prior to 5.0.14

Description Insufficient user capability checks on certain admin REST API routes allow users with Shop Manager privileges to install and activate arbitrary plugins from WordPress.org. The system incorrectly verifies only for a general WooCommerce management capability instead of the required installation capability.

Recommendations Update to version 5.0.14 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Khaled Alenazi

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers