# CVE-2026-10023: weDevs Dokan IDOR in Order AJAX Handlers

Source: https://junglewise.ai/threats/cve-2026-10023-wedevs-dokan-idor-in-order-ajax-handlers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-10023 · Severity: medium · CVSS 4.3 · Published 2026-06-18

Dokan is a popular WordPress plugin used to create multi-vendor marketplaces similar to Amazon or eBay. A security flaw allows registered vendors to modify orders that do not belong to them. An attacker could change order statuses, inject fake shipping information, or grant themselves access to downloadable products, potentially leading to financial loss or fraudulent activity within the marketplace.

Technologies: [weDevs Dokan](https://junglewise.ai/threats/technologies/dokan). Vendors: [weDevs](https://junglewise.ai/threats/vendors/wedevs).

## Quick answers

**Is CVE-2026-10023 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10023 being exploited in the wild.

**How severe is CVE-2026-10023?** Medium severity, with a CVSS score of 4.3, published 18 June 2026.

**Which products and versions are affected?** weDevs Dokan Up to and including 5.0.3.

**Is there a fix for CVE-2026-10023?** A patch was published on 2026-06-05: Fix submitted via GitHub Pull Request #3246 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10023 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-10023?** Check whether you run weDevs Dokan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in multiple AJAX handlers (change_order_status, add_order_note, delete_order_note, add_shipping_tracking_info, grant_access_to_download, and revoke_access_to_download) due to a lack of ownership validation on the user-supplied order ID. While the plugin checks for general vendor capabilities and validates nonces, it fails to verify that the requesting vendor actually owns the order being modified. Because nonces are generated on the vendor's own dashboard and are not tied to specific object IDs, an attacker can harvest a valid nonce from their own order page and replay it against any victim's order ID. This allows for unauthorized modification of order statuses, injection of order notes/comments, and manipulation of digital download permissions.

## Affected products

- weDevs Dokan: AI Powered WooCommerce Multivendor Marketplace Solution Up to and including 5.0.3

## Timeline

- 2026-06-05: patched: Fix submitted via GitHub Pull Request #3246
- 2026-06-18: advisory: NVD publication date

## References

- [https://github.com/getdokan/dokan/pull/3246](https://github.com/getdokan/dokan/pull/3246)
- [https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php](https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php)
- [https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php](https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php)
- [https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php](https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php)
- [https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php](https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php)
- [https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php](https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php)
- [https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php](https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/Ajax.php)

## Related threats

- [weDevs Dokan broken access control in user permissions](https://junglewise.ai/threats/cve-2026-119487-missing-authorization-vulnerability-in-wedevs-dokan-dokan-lite)
- [weDevs Dokan broken access control](https://junglewise.ai/threats/cve-2026-119485-missing-authorization-vulnerability-in-wedevs-dokan-dokan-lite)
- [weDevs Dokan PHP object injection](https://junglewise.ai/threats/cve-2026-115590-deserialization-of-untrusted-data-vulnerability-in-wedevs-dokan)
- [Dokan reverse withdrawal ledger manipulation via client-supplied amount](https://junglewise.ai/threats/cve-2026-16577-dokan-reverse-withdrawal-ledger-manipulation-via-client-supplied)
- [Dokan WordPress plugin unauthenticated commission settings disclosure](https://junglewise.ai/threats/cve-2026-16575-dokan-wordpress-plugin-unauthenticated-commission-settings)