# CVE-2026-65495: Dokan Multivendor Dokan Pro broken access control

Source: https://junglewise.ai/threats/cve-2026-65495-dokan-multivendor-dokan-pro-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65495 · Severity: high · CVSS 7.5 · Published 2026-07-23

Dokan Pro, a popular WordPress plugin used to create multi-vendor marketplaces, contains a security flaw that allows unauthorized users to perform actions they should not be able to access. An attacker could exploit this to disrupt site operations or delete data without needing a password or account. As of the latest report, no official patch has been released by the developer, though third-party mitigation rules are available.

Technologies: [weDevs Dokan Pro](https://junglewise.ai/threats/technologies/dokan-pro). Vendors: [weDevs](https://junglewise.ai/threats/vendors/wedevs).

## Quick answers

**Is CVE-2026-65495 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65495 being exploited in the wild.

**How severe is CVE-2026-65495?** High severity, with a CVSS score of 7.5, published 23 July 2026.

**Which products and versions are affected?** weDevs Dokan Pro <= 5.0.3.

**Is there a fix for CVE-2026-65495?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65495 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65495?** Check whether you run weDevs Dokan Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability (CWE-862) exists in the Dokan Pro plugin for WordPress through version 5.0.3. The flaw stems from a missing authorization check on a specific endpoint, allowing unauthenticated remote attackers to execute functions that should be restricted to administrative users. According to the advisory, the vulnerability specifically allows for unauthorized deletions. While a CVSS score of 7.5 is assigned, the vector indicates a high impact on availability (A:H) but no impact on confidentiality or integrity, though the advisory notes it could lead to unauthorized vendor-initiated deletions. No official patch is currently available.

## Affected products

- Dokan Multivendor Plugin Dokan Pro <= 5.0.3

## Timeline

- 2026-06-11: disclosed: Reported by VanTastic to Patchstack
- 2026-07-23: advisory: Public advisory published by Patchstack and NVD

## References

- [https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-3-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-3-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Dokan Dokan Pro SQL injection in Subscriber role](https://junglewise.ai/threats/cve-2026-65494-dokan-dokan-pro-sql-injection-in-subscriber-role)
- [Dokan Dokan Pro PHP Object Injection](https://junglewise.ai/threats/cve-2026-65493-dokan-dokan-pro-php-object-injection)
- [weDevs Dokan Pro unauthenticated XSS](https://junglewise.ai/threats/cve-2026-65492-wedevs-dokan-pro-unauthenticated-xss)
- [weDevs Dokan Pro privilege escalation in update_capabilities REST Endpoint](https://junglewise.ai/threats/cve-2026-12224-wedevs-dokan-pro-privilege-escalation-in-update-capabilities-rest)
- [Dokan Multivendor Plugin Dokan Pro unauthenticated privilege escalation](https://junglewise.ai/threats/cve-2026-56033-dokan-multivendor-plugin-dokan-pro-unauthenticated-privilege)