Is CVE-2026-89280 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89280 being exploited in the wild.

How severe is CVE-2026-89280?

Medium severity, with a CVSS score of 4.3, published 16 October 2026.

Which products and versions are affected?

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution up to and including 5.2.1.

Is there a fix for CVE-2026-89280?

A patch was published on 2026-10-08: Fix merged in PR #3433 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89280 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-89280?

Check whether you run Dokan: AI Powered WooCommerce Multivendor Marketplace Solution at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89280: Dokan WooCommerce Multivendor Marketplace insecure direct object reference in password reset

CVE-2026-89280 · Severity: medium · CVSS 4.3 · Published 2026-10-16

Dokan is a WordPress plugin that enables users to create multi-vendor marketplaces similar to Amazon or Etsy. An authenticated attacker with vendor-level access can reset customer passwords and take over accounts for any customer who has purchased from their shop. Since vendor registration can be self-enabled on public sites, this could allow a malicious third party to gain unauthorized access to legitimate customer accounts.

Vendors: Dokan.

Quick answers

Is CVE-2026-89280 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89280 being exploited in the wild.
How severe is CVE-2026-89280?: Medium severity, with a CVSS score of 4.3, published 16 October 2026.
Which products and versions are affected?: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution up to and including 5.2.1.
Is there a fix for CVE-2026-89280?: A patch was published on 2026-10-08: Fix merged in PR #3433 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89280 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-89280?: Check whether you run Dokan: AI Powered WooCommerce Multivendor Marketplace Solution at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to validate the 'password' parameter in the customers REST endpoint, allowing authenticated vendors to change passwords for customers via Insecure Direct Object Reference (IDOR). A vendor with custom-level access or higher can modify any customer password through this unvalidated parameter, provided that customer has placed an order with the attacking vendor. The vulnerability was patched by adding validation to block password and email changes on customer accounts via the REST API.

Affected products

Dokan Dokan: AI Powered WooCommerce Multivendor Marketplace Solution up to and including 5.2.1

Timeline

2026-10-16: disclosed
2026-10-08: patched: Fix merged in PR #3433

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.