Is CVE-2026-10023 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10023 being exploited in the wild.

How severe is CVE-2026-10023?

Medium severity, with a CVSS score of 4.3, published 18 June 2026.

Which products and versions are affected?

weDevs Dokan Up to and including 5.0.3.

Is there a fix for CVE-2026-10023?

A patch was published on 2026-06-05: Fix submitted via GitHub Pull Request #3246 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10023 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10023?

Check whether you run weDevs Dokan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10023: weDevs Dokan IDOR in Order AJAX Handlers

CVE-2026-10023 · Severity: medium · CVSS 4.3 · Published 2026-06-18

Dokan is a popular WordPress plugin used to create multi-vendor marketplaces similar to Amazon or eBay. A security flaw allows registered vendors to modify orders that do not belong to them. An attacker could change order statuses, inject fake shipping information, or grant themselves access to downloadable products, potentially leading to financial loss or fraudulent activity within the marketplace.

Technologies: weDevs Dokan. Vendors: weDevs.

Quick answers

Is CVE-2026-10023 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10023 being exploited in the wild.
How severe is CVE-2026-10023?: Medium severity, with a CVSS score of 4.3, published 18 June 2026.
Which products and versions are affected?: weDevs Dokan Up to and including 5.0.3.
Is there a fix for CVE-2026-10023?: A patch was published on 2026-06-05: Fix submitted via GitHub Pull Request #3246 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10023 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10023?: Check whether you run weDevs Dokan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in multiple AJAX handlers (change_order_status, add_order_note, delete_order_note, add_shipping_tracking_info, grant_access_to_download, and revoke_access_to_download) due to a lack of ownership validation on the user-supplied order ID. While the plugin checks for general vendor capabilities and validates nonces, it fails to verify that the requesting vendor actually owns the order being modified. Because nonces are generated on the vendor's own dashboard and are not tied to specific object IDs, an attacker can harvest a valid nonce from their own order page and replay it against any victim's order ID. This allows for unauthorized modification of order statuses, injection of order notes/comments, and manipulation of digital download permissions.

Affected products

weDevs Dokan: AI Powered WooCommerce Multivendor Marketplace Solution Up to and including 5.0.3

Timeline

2026-06-05: patched: Fix submitted via GitHub Pull Request #3246
2026-06-18: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.