2.7
Low
CVE-2026-107775 Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation
Description
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NExploitable remotely over the network, with an administrator account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution 5.3 | earliest → < 5.3.3 | 5.3.3 |
Other CVEs of Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
The 10 CVEs of Dokan: AI Powered WooCommerce Multivendor Marketplace Solution →
CVE-2026-107774
Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form
5.3
Medium
CVE-2026-107773
Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint
6.5
Medium
CVE-2026-107694
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that…
2.7
Low
CVE-2026-16577
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a…
2.7
Low