CVE-2026-16576: Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution (WordPress plugin)to a version that resolves this vulnerability.Fixed in 5.0.14 - Configuration
After updating Dokan, ensure the plugin’s admin REST API routes validate the correct capability (Dokan installation capability) rather than only checking for a WooCommerce management capability, to prevent Shop Managers from installing/activating arbitrary plugins via the REST API.
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution (WordPress plugin) Admin REST API route capability checks = Use Dokan installation capability instead of only WooCommerce management capability
Event History
Frequently Asked Questions
Which users can exploit this issue?
Users with a WooCommerce management capability, including Shop Managers, may be able to use the affected admin REST API routes. They do not need the capability normally required to install plugins.
What can an attacker do with this access?
They can install and activate arbitrary plugins from WordPress.org through the affected Dokan REST API routes. The issue affects Dokan versions before 5.0.14.
How can I determine whether my site is affected?
Check the installed Dokan version. Sites running a version earlier than 5.0.14 are affected if users with WooCommerce management privileges, such as Shop Managers, are present.