# CVE-2026-49780: weDevs Dokan privilege escalation in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-49780-wedevs-dokan-privilege-escalation-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-49780 · Severity: high · CVSS 8.8 · Published 2026-06-15

Dokan is a popular WordPress plugin used to create multi-vendor marketplaces. A security flaw in versions 5.0.2 and earlier allows users with basic 'Customer' accounts to gain higher-level administrative permissions. This could allow an attacker to take full control of the website, access sensitive business data, or disrupt marketplace operations.

Technologies: [weDevs Dokan](https://junglewise.ai/threats/technologies/dokan). Vendors: [weDevs](https://junglewise.ai/threats/vendors/wedevs).

## Quick answers

**Is CVE-2026-49780 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49780 being exploited in the wild.

**How severe is CVE-2026-49780?** High severity, with a CVSS score of 8.8, published 15 June 2026.

**Which products and versions are affected?** weDevs Dokan <= 5.0.2.

**Is there a fix for CVE-2026-49780?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49780 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49780?** Check whether you run weDevs Dokan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Dokan plugin for WordPress (versions up to and including 5.0.2) is vulnerable to privilege escalation due to incorrect privilege assignment (CWE-266). An attacker authenticated with a low-level 'Customer' role can exploit this vulnerability over the network without user interaction. Successful exploitation allows the attacker to escalate their privileges to a higher level, potentially gaining full administrative control over the WordPress site. The issue is addressed in version 5.0.3.

## Affected products

- weDevs Dokan <= 5.0.2

## Timeline

- 2026-04-29: other: Reported by Nguyen Ba Khanh
- 2026-06-03: advisory: Patchstack advisory published
- 2026-06-15: disclosed: CVE published to NVD

## References

- [https://patchstack.com/database/wordpress/plugin/dokan-lite/vulnerability/wordpress-dokan-plugin-5-0-2-privilege-escalation-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/dokan-lite/vulnerability/wordpress-dokan-plugin-5-0-2-privilege-escalation-vulnerability?_s_id=cve)

## Related threats

- [weDevs Dokan broken access control in user permissions](https://junglewise.ai/threats/cve-2026-119487-missing-authorization-vulnerability-in-wedevs-dokan-dokan-lite)
- [weDevs Dokan broken access control](https://junglewise.ai/threats/cve-2026-119485-missing-authorization-vulnerability-in-wedevs-dokan-dokan-lite)
- [weDevs Dokan PHP object injection](https://junglewise.ai/threats/cve-2026-115590-deserialization-of-untrusted-data-vulnerability-in-wedevs-dokan)
- [Dokan reverse withdrawal ledger manipulation via client-supplied amount](https://junglewise.ai/threats/cve-2026-16577-dokan-reverse-withdrawal-ledger-manipulation-via-client-supplied)
- [Dokan WordPress plugin unauthenticated commission settings disclosure](https://junglewise.ai/threats/cve-2026-16575-dokan-wordpress-plugin-unauthenticated-commission-settings)