CVE-2026-16564 Overview
CVE-2026-16564 affects the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin in versions prior to 5.0.9. The plugin exposes a REST endpoint that performs bulk order-status changes without verifying order ownership. Any authenticated user holding a Dokan vendor account can modify the status of any WooCommerce order on the marketplace. This includes orders belonging to other vendors and the store's own customers. The flaw is classified under [CWE-639] Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated vendors can tamper with any order status across the marketplace, disrupting fulfillment, refunds, and revenue recognition.
Affected Products
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin
- All versions before 5.0.9
- WordPress sites running WooCommerce with the Dokan multivendor module enabled
Discovery Timeline
- 2026-08-03 - CVE-2026-16564 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-16564
Vulnerability Analysis
The vulnerability resides in a REST API endpoint that handles bulk order-status updates for Dokan vendors. The endpoint accepts a list of order identifiers and a target status, then applies the change without validating that each order belongs to the calling vendor. Authorization is limited to confirming the caller has a vendor role, not that the caller owns the referenced orders.
An attacker with any legitimate Dokan vendor account can enumerate WooCommerce order IDs and submit them through the bulk-status endpoint. The plugin processes the request and updates order records belonging to other vendors or to customers of the underlying store. This is a classic Insecure Direct Object Reference pattern applied to a multi-tenant marketplace boundary.
Impact is limited to integrity of order status data. Attackers cannot read order contents or trigger denial of service through this endpoint alone, but they can mark orders as completed, cancelled, refunded, or on-hold, disrupting fulfillment and financial reconciliation.
Root Cause
The root cause is a missing ownership check on the REST controller that processes bulk order-status changes. The handler authenticates the vendor role but omits a per-object authorization check against the post_author or vendor mapping stored for each WooCommerce order.
Attack Vector
Exploitation requires network access to the WordPress REST API and a valid Dokan vendor account. The attacker sends a crafted request to the bulk order-status endpoint with target order IDs owned by other vendors or the parent store. See the WPScan Vulnerability Details advisory for reference to the affected endpoint behavior.
Detection Methods for CVE-2026-16564
Indicators of Compromise
- REST API requests to Dokan bulk order-status endpoints originating from a single vendor account referencing large numbers of order IDs
- WooCommerce order-status transitions logged with a vendor user ID that does not match the order's assigned vendor
- Sudden clusters of cancelled, refunded, or completed status changes across orders belonging to multiple vendors
Detection Strategies
- Correlate WordPress REST access logs with WooCommerce order metadata to flag status changes where the acting user is not the order's vendor
- Alert on bulk order-status API calls that reference more orders than a vendor's typical daily volume
- Review Dokan plugin version inventory to identify sites running versions earlier than 5.0.9
Monitoring Recommendations
- Enable WooCommerce order-status change auditing and forward events to a central log store
- Monitor the WordPress REST endpoint /wp-json/dokan/v1/orders/bulk (or equivalent) for anomalous POST volumes
- Track authentication events for Dokan vendor accounts and flag newly registered vendors that immediately invoke bulk endpoints
How to Mitigate CVE-2026-16564
Immediate Actions Required
- Update the Dokan plugin to version 5.0.9 or later on all affected WordPress installations
- Audit WooCommerce order history for unauthorized status transitions since the plugin was deployed
- Review and, where necessary, suspend vendor accounts that exhibit anomalous bulk-order activity
Patch Information
The vendor addressed CVE-2026-16564 in Dokan version 5.0.9 by adding order ownership validation on the affected REST endpoint. Refer to the WPScan Vulnerability Details entry for advisory tracking.
Workarounds
- Restrict access to Dokan REST endpoints at the web server or WAF layer for untrusted vendor accounts until patching is complete
- Temporarily disable the bulk order-status feature via plugin configuration where operationally acceptable
- Require administrator approval for status transitions on high-value orders through a workflow plugin or custom hook
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
