5.3
Medium
CVE-2026-16575 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict…
Description
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution 5.0 | earliest → < 5.0.14 | 5.0.14 |
Other CVEs of Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
The 10 CVEs of Dokan: AI Powered WooCommerce Multivendor Marketplace Solution →
CVE-2026-107774
Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form
5.3
Medium
CVE-2026-107773
Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint
6.5
Medium
CVE-2026-107775
Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation
2.7
Low
CVE-2026-107694
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that…
2.7
Low