CVE-2026-16565: Dokan WooCommerce Auth Bypass Vulnerability

CVE-2026-16565 Overview

CVE-2026-16565 affects the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress before version 5.0.9. The plugin fails to verify product ownership on its product-attribute REST write endpoints. Any authenticated user with a Dokan vendor account can modify product attributes and default attributes belonging to other vendors on the marketplace. The vulnerability is classified as [CWE-639] Authorization Bypass Through User-Controlled Key, an Insecure Direct Object Reference (IDOR) flaw. Exploitation requires only low-privileged vendor access over the network and no user interaction.

Critical Impact
Authenticated vendors can tamper with any other vendor's product attributes across the entire marketplace, undermining catalog integrity and vendor trust.

Affected Products

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions before 5.0.9
WordPress installations running WooCommerce with multi-vendor Dokan deployments
Marketplace sites exposing Dokan REST API endpoints to authenticated vendor accounts

Discovery Timeline

2026-08-03 - CVE-2026-16565 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16565

Vulnerability Analysis

The Dokan plugin exposes REST API endpoints that allow vendors to manage product attributes and default attributes on their own products. These write endpoints accept a product identifier as input but do not confirm that the authenticated vendor owns the referenced product. As a result, an attacker with any valid vendor account can submit crafted requests targeting product IDs owned by other vendors and successfully alter their attribute data.

The flaw is a business-logic authorization gap rather than an authentication issue. The plugin authenticates the request correctly but skips the ownership check that should follow. This category of weakness maps to [CWE-639], commonly described as Insecure Direct Object Reference (IDOR). Impact is limited to integrity of product attribute data; the endpoint does not disclose confidential data or affect availability of the marketplace.

Root Cause

The root cause is missing authorization logic in the permission callback of the product-attribute REST write handlers. The handler validates that the caller is a Dokan vendor but does not compare the target product's post_author with the current user ID before applying updates.

Attack Vector

An attacker registers or uses an existing vendor account on the target marketplace. The attacker then issues authenticated REST requests to the vulnerable product-attribute endpoints, substituting product IDs belonging to competing vendors. The server accepts and applies the modifications. See the WPScan Vulnerability Advisory for technical details on the affected endpoints.

No verified public exploit code is available for this vulnerability. Refer to the vendor advisory for endpoint-level specifics.

Detection Methods for CVE-2026-16565

Indicators of Compromise

Unexpected changes to product_attributes or default_attributes metadata on WooCommerce products, especially edits made by a user ID that does not match the product's post_author.
REST API access log entries showing authenticated POST, PUT, or PATCH requests to Dokan product-attribute endpoints where the requesting vendor does not own the target product.
Vendor complaints about unauthorized modifications to their product listings or variation defaults.

Detection Strategies

Audit the WooCommerce database for recent modifications to product attribute postmeta rows and correlate the modifying user against product ownership.
Enable REST API request logging and flag requests where the authenticated user ID differs from the post_author of the product being updated.
Review Dokan activity logs and WooCommerce order/product change history for edits performed outside normal vendor workflows.

Monitoring Recommendations

Instrument WordPress with a security plugin or web application firewall (WAF) that records authenticated REST API activity per vendor.
Alert on high-volume attribute update requests from a single vendor account targeting many distinct product IDs.
Track baseline attribute change rates per vendor and investigate deviations that exceed normal operational patterns.

How to Mitigate CVE-2026-16565

Immediate Actions Required

Upgrade the Dokan plugin to version 5.0.9 or later on all WordPress instances that host multivendor marketplaces.
Audit product attribute changes made prior to patching and restore any unauthorized modifications from backups.
Review vendor account registrations for suspicious or throwaway accounts created before the patch window.

Patch Information

Upgrade to Dokan version 5.0.9 or later, which introduces the missing ownership verification on the product-attribute REST write endpoints. Details are documented in the WPScan Vulnerability Advisory.

Workarounds

If immediate patching is not possible, restrict access to Dokan REST endpoints at the web server or WAF layer for accounts that do not require attribute management.
Temporarily disable vendor self-service product editing and require administrator approval for attribute changes.
Increase scrutiny of new vendor registrations and require manual verification before granting attribute-editing capability.

bash

# Configuration example: WAF rule pattern to log Dokan product-attribute REST writes
# Review these logs to correlate authenticated user vs. target product ownership
Location ~* "/wp-json/dokan/.*/products/.*/(attributes|default-attributes)" {
    access_log /var/log/nginx/dokan_attr_writes.log;
}