Executive brief
Dokan is a popular WordPress plugin that powers multivendor marketplaces on WooCommerce, allowing multiple sellers to operate storefronts. A flaw in the plugin's REST API allows any unauthenticated user to retrieve sensitive commission configuration details—including commission rates and fee structures—for any vendor without authentication, potentially enabling competitors or bad actors to gather competitive intelligence or identify business relationships.
Technical details
The vulnerability is an information disclosure issue (CWE-200) in Dokan's Store Categories REST endpoint (/dokan/v1/stores/{store_id}/categories). The endpoint fails to restrict access to sensitive admin-only fields including admin_commission_type and per-category commission rates in API responses. An unauthenticated attacker can directly call this endpoint using a vendor's user ID to extract commission configuration data. The vulnerability requires no authentication, cookies, or CSRF tokens; a simple HTTP GET request is sufficient. A single-store endpoint correctly strips this data, indicating inconsistent access control implementation. The plugin was patched in version 5.0.14.
Affected products
- weDevs Dokan before 5.0.14
Timeline
- 2026-08-19: disclosed
- 2026-08-21: advisory
- 2026-08-21: patched: Fixed in version 5.0.14