CVE-2026-107694: Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint

Q: Who can exploit this issue?

A vendor account can exploit it. The flaw allows a vendor to request commission-calculation information for a different vendor and view that other vendor's configured commission rate and fixed fee.

Q: What versions are affected?

Dokan versions before 5.2.0 are affected. Version 5.2.0 or later is not identified as affected by the provided information.

Q: What information can be disclosed?

The disclosed information is the commission rate and fixed fee configured by the marketplace administrator for other vendors. The provided information does not indicate disclosure of other vendor data.

Q: What should be prioritized for remediation?

Update Dokan to version 5.2.0 or later. Until updating is possible, treat vendor access to the commission calculation REST endpoint as capable of exposing other vendors' commission settings.

Published Oct 11, 2026

Updated

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.

Affected Software

1 affected component

weDevs Dokan<5.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to a version that resolves this vulnerability.
Fixed in 5.2.0

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A vendor account can exploit it. The flaw allows a vendor to request commission-calculation information for a different vendor and view that other vendor's configured commission rate and fixed fee.

What versions are affected?

Dokan versions before 5.2.0 are affected. Version 5.2.0 or later is not identified as affected by the provided information.

What information can be disclosed?

The disclosed information is the commission rate and fixed fee configured by the marketplace administrator for other vendors. The provided information does not indicate disclosure of other vendor data.

What should be prioritized for remediation?

Update Dokan to version 5.2.0 or later. Until updating is possible, treat vendor access to the commission calculation REST endpoint as capable of exposing other vendors' commission settings.

CVE-2026-107694: Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What versions are affected?

What information can be disclosed?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What versions are affected?

What information can be disclosed?

What should be prioritized for remediation?