CVE-2026-16575: Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Dokan: AI Powered WooCommerce Multivendor Marketplace Solutionto a version that resolves this vulnerability.Fixed in 5.0.14
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user can query the affected store REST endpoint. No WordPress account or vendor access is required.
What information can be exposed?
The endpoint can disclose a vendor's commission type. If category-based commission is configured, it can also reveal per-category commission rates and the default commission rate.
When is the most sensitive information exposed?
Per-category and default commission rates are exposed when the affected vendor uses category-based commission configuration. The commission type is disclosed regardless.
How can I determine whether my site is affected?
Sites using the Dokan WordPress plugin before version 5.0.14 are affected. Review unauthenticated responses from the plugin's store REST endpoint to determine whether vendor commission settings are returned.