6.5
Medium
CVE-2026-107773 Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint
Description
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution 5.3 | earliest → < 5.3.3 | 5.3.3 |
Other CVEs of Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
The 10 CVEs of Dokan: AI Powered WooCommerce Multivendor Marketplace Solution →
CVE-2026-107774
Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form
5.3
Medium
CVE-2026-107775
Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation
2.7
Low
CVE-2026-107694
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that…
2.7
Low
CVE-2026-16577
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a…
2.7
Low