CVE-2026-3504: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.1 via the '/dokan/v1/stores/{id}/reviews' REST API endpoint. This is due to the 'preparereviewsforresponse' method including reviewer email addresses, usernames, and user IDs in the API response. This makes it possible for unauthenticated attackers to extract email addresses, usernames, and user IDs of all customers who left reviews on any vendor's store. The Pro version of the plugin must be installed and activated, with store reviews enabled, in order to exploit the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3504?
CVE-2026-3504 is classified as a critical vulnerability due to its potential for unauthenticated information disclosure.
How do I fix CVE-2026-3504?
To mitigate CVE-2026-3504, update the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin to version 4.3.2 or later.
What type of information is exposed in CVE-2026-3504?
CVE-2026-3504 can expose sensitive information through the Store Reviews REST API Endpoint without authentication.
Is my WordPress site affected by CVE-2026-3504?
If you are using Dokan (Pro) version 4.3.1 or earlier, your WordPress site is vulnerable to CVE-2026-3504.
How can I determine if I am using an affected version related to CVE-2026-3504?
Check your Dokan plugin version in the WordPress admin panel under Installed Plugins to see if it is 4.3.1 or prior.