# CVE-2026-107774: Dokan multivendor marketplace plugin email sender spoofing in store contact form

Source: https://junglewise.ai/threats/cve-2026-107774-the-dokan-ai-powered-woocommerce-multivendor-marketplace  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-107774 · Severity: info · Published 2026-11-05

Dokan is a WooCommerce plugin that enables multivendor marketplace functionality. The plugin's store contact form allows unauthenticated attackers to spoof email sender addresses, making it appear that emails are sent from trusted site addresses like the administrator account. This enables attackers to craft fraudulent communications to vendors and other site users.

Vendors: [WebAppick](https://junglewise.ai/threats/vendors/webappick).

## Quick answers

**Is CVE-2026-107774 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107774 being exploited in the wild.

**How severe is CVE-2026-107774?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** WebAppick Dokan before 5.3.3.

**Is there a fix for CVE-2026-107774?** Yes: fixed in 5.3.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107774 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-107774?** Check whether you run WebAppick Dokan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.3.3

## Technical details

The vulnerability exists in the store contact form handling where user-supplied email addresses are placed directly in the From header instead of being validated or moved to a Reply-To header, allowing sender spoofing. An unauthenticated attacker can exploit this to make emails appear to originate from any address on the site's domain, bypassing SPF/DKIM protections that would normally prevent external spoofing. The attacker gains the ability to send phishing or social engineering messages to vendors impersonating trusted administrators.

## Affected products

- WebAppick Dokan before 5.3.3

## Timeline

- 2026-11-03: disclosed
- 2026-11-05: advisory

## References

- [https://wpscan.com/vulnerability/1d1d7ba1-9c69-47b2-beb4-ed02066cb02b/](https://wpscan.com/vulnerability/1d1d7ba1-9c69-47b2-beb4-ed02066cb02b/)