GHSA-Q7FJ-7HXW-7X69

Vulnerability from github – Published: 2026-08-05 06:30 – Updated: 2026-08-05 06:30
VLAI
Details

The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the CustomersController REST controller (includes/REST/CustomersController.php), which re-registers WooCommerce's customer CRUD routes under the /dokan/v1/customers/ namespace and replaces WooCommerce's native manage_woocommerce capability check with a vendor-only check that inspects the requesting user's role and never validates the target user. This makes it possible for authenticated attackers with Vendor/Seller-level access and above to read, modify, or delete any WordPress user — including administrators — via GET/PUT/DELETE requests against /wp-json/dokan/v1/customers/{id}. Setting the password parameter on an administrator's record yields a full site takeover.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-8761"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-05T06:16:40Z",
    "severity": "HIGH"
  },
  "details": "The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the `CustomersController` REST controller (`includes/REST/CustomersController.php`), which re-registers WooCommerce\u0027s customer CRUD routes under the `/dokan/v1/customers/` namespace and replaces WooCommerce\u0027s native `manage_woocommerce` capability check with a vendor-only check that inspects the **requesting** user\u0027s role and never validates the **target** user. This makes it possible for authenticated attackers with Vendor/Seller-level access and above to read, modify, or delete any WordPress user \u2014 including administrators \u2014 via `GET`/`PUT`/`DELETE` requests against `/wp-json/dokan/v1/customers/{id}`. Setting the `password` parameter on an administrator\u0027s record yields a full site takeover.",
  "id": "GHSA-q7fj-7hxw-7x69",
  "modified": "2026-08-05T06:30:33Z",
  "published": "2026-08-05T06:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8761"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/REST/CustomersController.php#L280"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/REST/CustomersController.php#L281"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/REST/CustomersController.php#L60"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.0.1/includes/REST/CustomersController.php#L80"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/CustomersController.php#L280"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/CustomersController.php#L281"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/CustomersController.php#L60"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/CustomersController.php#L80"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?new=3541712%40dokan-lite%2Ftags%2F5.0.3\u0026old=3535602%40dokan-lite%2Ftags%2F5.0.2"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/24666f75-9179-4043-841b-4dd83be078e8?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.