CVE-2026-107694: Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokan: AI Powered WooCommerce Multivendor Marketplace Solutionto a version that resolves this vulnerability.Fixed in 5.2.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A vendor account can exploit it. The flaw allows a vendor to request commission-calculation information for a different vendor and view that other vendor's configured commission rate and fixed fee.
What versions are affected?
Dokan versions before 5.2.0 are affected. Version 5.2.0 or later is not identified as affected by the provided information.
What information can be disclosed?
The disclosed information is the commission rate and fixed fee configured by the marketplace administrator for other vendors. The provided information does not indicate disclosure of other vendor data.
What should be prioritized for remediation?
Update Dokan to version 5.2.0 or later. Until updating is possible, treat vendor access to the commission calculation REST endpoint as capable of exposing other vendors' commission settings.