CVE-2025-14977: Dokan WordPress IDOR Vulnerability

CVE-2025-14977 Overview

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in versions up to and including 4.2.4. The vulnerability exists in the /wp-json/dokan/v1/settings REST API endpoint due to missing validation on a user-controlled key. This flaw enables authenticated attackers with customer-level permissions or above to read or modify other vendors' store settings, including highly sensitive payment information.

Critical Impact

Attackers can access and modify sensitive payment data including PayPal email addresses, bank account details, routing numbers, IBAN, and SWIFT codes, enabling financial theft when the marketplace processes payouts.

Affected Products

• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress versions up to and including 4.2.4
• WordPress installations using the vulnerable Dokan-lite plugin
• WooCommerce-based multivendor marketplaces utilizing Dokan for vendor management

Discovery Timeline

• 2026-01-20 - CVE-2025-14977 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-14977

Vulnerability Analysis

This Insecure Direct Object Reference vulnerability resides within the StoreSettingController.php file of the Dokan plugin. The REST API endpoint fails to properly validate whether the requesting user has authorization to access or modify the specified vendor's store settings. When a request is made to the /wp-json/dokan/v1/settings endpoint, the application accepts a user-controlled vendor ID parameter without verifying that the authenticated user owns or has legitimate access to that vendor's data.

The vulnerability allows attackers to enumerate and access vendor store configurations belonging to other users. This includes the ability to both read sensitive information and modify critical settings. The attack can be executed remotely over the network by any authenticated user with at least customer-level privileges, requiring no special conditions or user interaction.

Root Cause

The root cause of this vulnerability is classified under CWE-284 (Improper Access Control). The StoreSettingController.php file lacks proper authorization checks in multiple functions handling vendor settings. The vulnerable code paths fail to validate that the authenticated user's identity matches the vendor ID being accessed or modified. This missing access control validation allows any authenticated user to manipulate the vendor ID parameter in API requests to access arbitrary vendor accounts.

Attack Vector

The attack is network-based and exploits the REST API endpoint directly. An attacker with a valid customer account on the WordPress marketplace can craft API requests targeting the vulnerable endpoint while substituting their own vendor ID with that of other vendors. The attack flow involves:

1. Creating or using an existing customer account on the vulnerable marketplace
2. Discovering valid vendor IDs through enumeration or other means
3. Sending authenticated REST API requests to /wp-json/dokan/v1/settings with a manipulated vendor ID parameter
4. Extracting sensitive payment information including PayPal credentials, bank account details, and personal contact information
5. Optionally modifying the payment configuration to redirect vendor payouts to attacker-controlled accounts

The vulnerability requires low privileges (authenticated customer access) and involves no user interaction, making it highly exploitable in real-world scenarios.

Detection Methods for CVE-2025-14977

Indicators of Compromise

• Unusual API requests to /wp-json/dokan/v1/settings endpoints with mismatched user/vendor IDs
• Multiple sequential requests to vendor settings endpoints from a single authenticated session with varying vendor ID parameters
• Unauthorized modifications to vendor payment settings, particularly PayPal email addresses or bank account information
• Access logs showing customer-level accounts accessing vendor administrative endpoints

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and alert on requests to Dokan REST API endpoints with suspicious parameter manipulation
• Monitor WordPress REST API access logs for patterns indicating vendor ID enumeration or unauthorized settings access
• Deploy file integrity monitoring on StoreSettingController.php and related Dokan plugin files to detect unauthorized modifications
• Review database audit logs for unexpected changes to vendor payment configuration tables

Monitoring Recommendations

• Enable detailed logging for all Dokan REST API endpoints and establish baseline normal activity patterns
• Configure alerting for vendor payment information changes, requiring additional verification for PayPal email or bank detail modifications
• Implement rate limiting on the /wp-json/dokan/v1/settings endpoint to slow potential enumeration attacks
• Monitor for complaints from vendors regarding unauthorized account changes or missing payouts

How to Mitigate CVE-2025-14977

Immediate Actions Required

• Update the Dokan plugin to the latest patched version immediately via the WordPress plugin update mechanism
• Audit all vendor payment settings for unauthorized modifications, particularly PayPal email addresses and bank account details
• Review access logs for evidence of exploitation and identify any compromised vendor accounts
• Notify affected vendors if unauthorized access is detected and assist with payment information verification

Patch Information

A security patch addressing this vulnerability has been released by the Dokan developers. The fix can be reviewed in the WordPress Dokan-Lite Changeset. The patch implements proper authorization validation in the StoreSettingController.php file to ensure users can only access and modify their own vendor settings. Additional technical details about the vulnerable code paths are available in the Wordfence Vulnerability Analysis.

Workarounds

• If immediate patching is not possible, restrict access to the Dokan REST API endpoints at the web server level using IP allowlisting or additional authentication
• Implement a WordPress security plugin with REST API monitoring and blocking capabilities for suspicious request patterns
• Temporarily disable the Dokan plugin's REST API functionality if marketplace operations can continue without it
• Add custom authorization middleware to validate vendor ownership before processing settings requests

# Apache configuration to restrict Dokan REST API access
# Add to .htaccess or Apache configuration
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/dokan/v1/settings [NC]
    RewriteCond %{REMOTE_ADDR} !^(TRUSTED_IP_ADDRESS)$
    RewriteRule ^ - [F,L]
</IfModule>