CVE-2026-107775: Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation

Q: Who is exposed to this issue?

WordPress Multisite deployments using a Dokan version before 5.3.3 are exposed. The affected role is a subsite Administrator, who can enable seller status for users outside that subsite, including network-level users.

Q: What access does an attacker need?

An attacker needs Administrator privileges on a WordPress Multisite subsite. The issue is an authorization failure in the seller-enablement action, not an unauthenticated attack.

Q: What is the impact of successful exploitation?

A subsite Administrator can activate marketplace seller status for users they are not authorized to manage. This can include users outside their own site and network-level users.

Q: What version resolves the issue?

Update Dokan to version 5.3.3 or later. Versions before 5.3.3 are affected according to the available information.

Published Nov 5, 2026

Updated

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to a version that resolves this vulnerability.
Fixed in 5.3.3

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who is exposed to this issue?

WordPress Multisite deployments using a Dokan version before 5.3.3 are exposed. The affected role is a subsite Administrator, who can enable seller status for users outside that subsite, including network-level users.

What access does an attacker need?

An attacker needs Administrator privileges on a WordPress Multisite subsite. The issue is an authorization failure in the seller-enablement action, not an unauthenticated attack.

What is the impact of successful exploitation?

A subsite Administrator can activate marketplace seller status for users they are not authorized to manage. This can include users outside their own site and network-level users.

What version resolves the issue?

Update Dokan to version 5.3.3 or later. Versions before 5.3.3 are affected according to the available information.

CVE-2026-107775: Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need?

What is the impact of successful exploitation?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need?

What is the impact of successful exploitation?

What version resolves the issue?