CVE-2026-16575 Overview
CVE-2026-16575 affects the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin in versions prior to 5.0.14. The plugin exposes per-vendor commission configuration through an unauthenticated store REST endpoint without access controls. Any unauthenticated user can query the endpoint and disclose a vendor's commission type. When category-based commission is configured, attackers can also retrieve per-category and default commission rates. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can enumerate vendor commission structures across any Dokan-powered marketplace, exposing business-sensitive marketplace configuration.
Affected Products
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin
- All versions before 5.0.14
- WooCommerce marketplaces running vulnerable Dokan installations
Discovery Timeline
- 2026-08-21 - CVE-2026-16575 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-16575
Vulnerability Analysis
The Dokan plugin registers a store-related REST API endpoint that returns vendor profile data. The endpoint does not enforce authentication or capability checks around the commission configuration fields it serializes into the response. As a result, commission data intended for internal marketplace administration is returned to any client that queries the endpoint.
The disclosed data set includes the vendor's commission type. When the vendor is configured with category-based commissions, the response also includes the default rate and each configured per-category rate. Competitors, prospective vendors, or automated scrapers can enumerate these values across every vendor on the marketplace.
Root Cause
The root cause is missing authorization on a public-facing REST route [CWE-200]. The endpoint was designed to expose store-front information, but the controller returns the full vendor configuration object, including commission fields that should be restricted to marketplace administrators and the vendor account itself.
Attack Vector
The attack requires no authentication, no user interaction, and only network access to the target WordPress site. An attacker issues an HTTP GET request to the affected Dokan store REST endpoint and parses the JSON response for commission fields. Because vendor IDs are enumerable through public store listings, an attacker can iterate through all vendors on a marketplace and collect the complete commission structure.
Refer to the WPScan Vulnerability Report for technical details on the affected endpoint.
Detection Methods for CVE-2026-16575
Indicators of Compromise
- Unauthenticated HTTP GET requests to Dokan store REST endpoints under /wp-json/dokan/ originating from a single source across many vendor IDs
- Sequential or scripted access patterns targeting vendor profile routes
- Unusual user agents or missing Referer headers on requests to store REST routes
Detection Strategies
- Inspect WordPress access logs for high-volume requests to /wp-json/dokan/v1/stores/* and related routes returning HTTP 200 with commission-related JSON keys
- Deploy a Web Application Firewall (WAF) rule to flag rapid enumeration of vendor IDs against Dokan REST paths
- Correlate REST endpoint access with the installed Dokan version reported by the site to prioritize vulnerable hosts
Monitoring Recommendations
- Alert on response payloads from Dokan endpoints containing commission_type, commission_rate, or category-commission keys served to unauthenticated sessions
- Track baseline request rates to store REST endpoints and generate alerts on statistically significant spikes
- Forward WordPress and reverse-proxy logs to a centralized analytics platform for retrospective hunting once patches are applied
How to Mitigate CVE-2026-16575
Immediate Actions Required
- Upgrade the Dokan plugin to version 5.0.14 or later on all WordPress sites running the multivendor marketplace
- Audit recent access logs for enumeration activity against Dokan store REST endpoints and preserve evidence
- Review vendor commission configurations for competitive-sensitivity exposure and rotate any business terms that must remain confidential
Patch Information
The vendor addressed the issue in Dokan version 5.0.14 by restricting the affected store REST endpoint so commission configuration is no longer returned to unauthenticated callers. Administrators should update through the WordPress plugin manager or WP-CLI. Details are available in the WPScan Vulnerability Report.
Workarounds
- Block or rate-limit unauthenticated requests to Dokan REST routes at the WAF or reverse proxy until the plugin is updated
- Restrict access to /wp-json/dokan/ endpoints by IP allowlist where feasible for administrative environments
- Disable category-based commission configuration temporarily to reduce the sensitivity of any data still returned by the endpoint
# Update Dokan via WP-CLI to the fixed version
wp plugin update dokan-lite --version=5.0.14
wp plugin update dokan-pro --version=5.0.14
wp plugin list --name=dokan-lite --fields=name,version,status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
