Is CVE-2026-107773 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107773 being exploited in the wild.

How severe is CVE-2026-107773?

Informational severity, published 5 November 2026.

Is there a fix for CVE-2026-107773?

Yes: fixed in 5.3.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107773 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107773?

Check whether you run Dokan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107773: Dokan WordPress plugin authorization bypass in REST Orders endpoint

CVE-2026-107773 · Severity: info · Published 2026-11-05

Dokan is a WordPress plugin that enables multivendor marketplace functionality on WooCommerce stores. The plugin fails to properly verify user permissions when accessing individual orders through its REST API, allowing attackers without login credentials to view sensitive customer and order information, and to add or delete order notes on affected orders.

Vendors: Dokan.

Quick answers

Is CVE-2026-107773 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107773 being exploited in the wild.
How severe is CVE-2026-107773?: Informational severity, published 5 November 2026.
Which products and versions are affected?: Dokan before 5.3.3.
Is there a fix for CVE-2026-107773?: Yes: fixed in 5.3.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107773 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107773?: Check whether you run Dokan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.3.3

Technical details

The vulnerability is an authorization bypass (CWE-863) in the REST Orders endpoint that fails to validate whether a requester has permission to access a specific order and its notes. Unauthenticated attackers can read personally identifiable information (PII) and modify order notes without authentication. The flaw affects Dokan versions before 5.3.3 and is exploitable via network requests to the REST API.

Affected products

Dokan Dokan before 5.3.3

Timeline

2026-11-03: disclosed
2026-11-05: advisory

References

https://wpscan.com/vulnerability/7ef1f47f-60d2-41f0-afca-584752503fae/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.