CVE-2026-16574: Dokan WordPress Plugin Auth Bypass Flaw

CVE-2026-16574 Overview

CVE-2026-16574 is a broken access control vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before version 5.0.11. The plugin fails to verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints. An authenticated vendor can abuse this flaw to grant their own customers free download access to another vendor's paid downloadable files. The weakness is categorized as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated vendor on a Dokan-powered marketplace can distribute another vendor's paid downloadable products to their own customers without payment, causing direct revenue loss and intellectual property exposure.

Affected Products

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions before 5.0.11
WordPress sites running WooCommerce with the vulnerable Dokan plugin
Multivendor marketplaces selling downloadable digital products through Dokan

Discovery Timeline

2026-08-08 - CVE-2026-16574 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-16574

Vulnerability Analysis

The Dokan plugin exposes REST endpoints that vendors use to manage orders and grant download permissions for digital products. One of these order endpoints processes requests to grant download access without validating that the referenced downloadable product actually belongs to the authenticated vendor issuing the request. The authorization check confirms the caller is a vendor but does not tie the target product to the caller's vendor identity.

The vulnerability is an Insecure Direct Object Reference (IDOR) pattern. A vendor supplies a product identifier controlled through the request, and the endpoint accepts it without verifying ownership. As a result, a vendor can reference any downloadable product on the marketplace, including paid products owned by other vendors, and issue free download grants tied to their own customer accounts.

Root Cause

The root cause is a missing ownership check in the REST controller handling downloadable order permissions. The code trusts the vendor role for the authorization decision instead of enforcing a per-resource check that ties the product to the vendor's own store. This matches the [CWE-639] pattern where an authenticated user references an object identifier belonging to another tenant.

Attack Vector

Exploitation requires an authenticated vendor account on the target marketplace, which is trivially obtainable on open multivendor platforms that accept vendor signups. The attacker sends a crafted request to the vulnerable order REST endpoint, referencing a downloadable product identifier owned by another vendor along with a customer they control. The endpoint issues a valid download permission entry, and the attacker's customer can then download the paid file at no cost. No user interaction from the victim vendor is required, and the attack can be scripted at scale against every downloadable product on the marketplace. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-16574

Indicators of Compromise

Entries in the wp_woocommerce_downloadable_product_permissions table where the granted_by vendor does not match the product's owning vendor.
Access log entries showing authenticated POST or PUT requests to Dokan order REST routes referencing product IDs outside the caller's vendor catalog.
Download activity from customer accounts for products that were never purchased through a completed order.

Detection Strategies

Audit the WooCommerce downloadable permissions table and reconcile each row against the vendor ownership of the referenced product ID.
Review WordPress and web server access logs for calls to Dokan order REST endpoints (/wp-json/dokan/v1/orders/...) issued by vendor accounts targeting product IDs they do not own.
Correlate Dokan order records with WooCommerce order totals to identify download grants that were issued without a matching paid line item.

Monitoring Recommendations

Enable verbose REST API logging for the Dokan namespace and forward it to a centralized log store for retention and search.
Alert on any REST call that mutates downloadable permissions where the acting vendor ID does not equal the product's post_author or Dokan store owner.
Track download counts for high-value digital products and investigate spikes that are not backed by corresponding sales revenue.

How to Mitigate CVE-2026-16574

Immediate Actions Required

Update the Dokan plugin to version 5.0.11 or later on every WordPress site running the multivendor marketplace.
Revoke unexpected wp_woocommerce_downloadable_product_permissions rows created after the plugin was installed and prior to patching.
Rotate download URLs for affected products so previously issued permission tokens no longer resolve to the file.

Patch Information

The vendor addressed this issue in Dokan version 5.0.11. The fix adds an ownership verification step that ensures the downloadable product referenced in the order REST endpoint belongs to the vendor issuing the request. Refer to the WPScan Vulnerability Report for the advisory record.

Workarounds

Restrict access to the Dokan order REST namespace at the web server or WAF layer until the plugin is updated.
Temporarily disable vendor signups and pause vendor-initiated download permission grants where operationally feasible.
Require manual administrator approval before any downloadable permission is issued outside a completed WooCommerce order.

bash

# Update the Dokan plugin using WP-CLI
wp plugin update dokan-lite --version=5.0.11
wp plugin update dokan-pro --version=5.0.11

# Verify the installed version
wp plugin get dokan-lite --field=version