CVE-2026-16577: Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal ledger with an arbitrary amount and clear their real commission debt without paying.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
A vendor can exploit it, because the vulnerable reverse-withdrawal payment flow accepts a client-supplied payment amount without validating it against that vendor's outstanding balance.
What can an attacker achieve?
An attacker acting as a vendor can credit their reverse-withdrawal ledger with an arbitrary amount and clear real commission debt without making the corresponding payment.
Are installations running version 5.0.14 affected?
The issue affects Dokan versions before 5.0.14. The provided information does not identify any affected versions at or above 5.0.14.