CVE-2026-107773: Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint

Q: Which installations are affected?

Installations running the Dokan WordPress plugin before version 5.3.3 are affected.

Q: What can an unauthenticated attacker do?

An attacker can access customer and order information for a subset of orders, and can add or delete notes associated with those orders. No authentication is required.

Q: Are all orders exposed?

The available information states that the issue affects only a subset of orders; it does not identify the conditions that determine whether a particular order is affected.

Q: Is there evidence that exploitation is practical?

A proof-of-concept flag is associated with this vulnerability, indicating that proof-of-concept exploit material exists.

Published Nov 5, 2026

Updated

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which installations are affected?

Installations running the Dokan WordPress plugin before version 5.3.3 are affected.

What can an unauthenticated attacker do?

An attacker can access customer and order information for a subset of orders, and can add or delete notes associated with those orders. No authentication is required.

Are all orders exposed?

The available information states that the issue affects only a subset of orders; it does not identify the conditions that determine whether a particular order is affected.

Is there evidence that exploitation is practical?

A proof-of-concept flag is associated with this vulnerability, indicating that proof-of-concept exploit material exists.

CVE-2026-107773: Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint

Event History

Frequently Asked Questions

Which installations are affected?

What can an unauthenticated attacker do?

Are all orders exposed?

Is there evidence that exploitation is practical?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What can an unauthenticated attacker do?

Are all orders exposed?

Is there evidence that exploitation is practical?