Executive brief
Dokan is a popular WordPress plugin used to create multi-vendor marketplaces similar to Amazon or eBay. A security flaw allows registered vendors to modify orders that do not belong to them. An attacker could change order statuses, inject fake shipping information, or grant themselves access to downloadable products, potentially leading to financial loss or fraudulent activity within the marketplace.
Technical details
The vulnerability exists in multiple AJAX handlers (change_order_status, add_order_note, delete_order_note, add_shipping_tracking_info, grant_access_to_download, and revoke_access_to_download) due to a lack of ownership validation on the user-supplied order ID. While the plugin checks for general vendor capabilities and validates nonces, it fails to verify that the requesting vendor actually owns the order being modified. Because nonces are generated on the vendor's own dashboard and are not tied to specific object IDs, an attacker can harvest a valid nonce from their own order page and replay it against any victim's order ID. This allows for unauthorized modification of order statuses, injection of order notes/comments, and manipulation of digital download permissions.
Affected products
- weDevs Dokan: AI Powered WooCommerce Multivendor Marketplace Solution Up to and including 5.0.3
Timeline
- 2026-06-05: patched: Fix submitted via GitHub Pull Request #3246
- 2026-06-18: advisory: NVD publication date
References
- https://github.com/getdokan/dokan/pull/3246
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php
- https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php