CVE-2026-16576: Dokan WordPress Plugin Auth Bypass Flaw

CVE-2026-16576 Overview

CVE-2026-16576 is a broken access control vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin in versions before 5.0.14. The plugin fails to correctly validate user capabilities on several admin REST API routes. It checks for a WooCommerce management capability instead of a plugin installation capability. This mismatch allows lower-privileged users such as Shop Managers to install and activate arbitrary plugins from WordPress.org through the affected endpoints.

Critical Impact
Authenticated users with Shop Manager privileges can install and activate arbitrary WordPress.org plugins, expanding the attack surface and enabling secondary code execution paths.

Affected Products

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin
All versions prior to 5.0.14
WordPress sites running WooCommerce with Shop Manager or equivalent roles

Discovery Timeline

2026-08-21 - CVE-2026-16576 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-16576

Vulnerability Analysis

The vulnerability is a broken access control flaw classified under [CWE-284] (Improper Access Control). The Dokan plugin exposes admin-facing REST API routes that permit installation and activation of WordPress.org plugins. These routes rely on a WooCommerce management capability check rather than the WordPress install_plugins capability. As a result, any user granted WooCommerce management rights, including the standard Shop Manager role, can invoke plugin installation logic reserved for administrators.

WordPress separates capabilities intentionally so that store operators do not gain code-deployment rights. Substituting a management capability for install_plugins collapses that boundary. Once installed, the plugin can be activated in the same request flow, giving the attacker the ability to introduce new code paths under the site's execution context.

Root Cause

The root cause is an incorrect permission_callback check on affected REST API routes. The handlers verify a capability tied to WooCommerce operations rather than the capability required for plugin installation. This design error violates the principle of least privilege and enables vertical privilege escalation from Shop Manager toward administrator-equivalent actions.

Attack Vector

An attacker must first obtain or compromise an account with WooCommerce management privileges, such as a Shop Manager. From that authenticated context, the attacker issues a request to the vulnerable Dokan REST API route and specifies an arbitrary plugin slug hosted on WordPress.org. The endpoint downloads, installs, and activates the requested plugin. The attacker can chain this access to install a plugin containing a known vulnerability or backdoor functionality, achieving broader compromise of the WordPress site.

See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-16576

Indicators of Compromise

Unexpected entries in the WordPress wp_options table under active_plugins referencing plugins not deployed by administrators
New plugin directories appearing under wp-content/plugins/ with modification timestamps tied to Shop Manager account activity
REST API access log entries to Dokan admin routes originating from non-administrator user sessions

Detection Strategies

Correlate WordPress audit logs with web server access logs for POST requests to Dokan admin REST endpoints followed by plugin activation events
Alert on any plugin install or activate action performed by a user whose role is not Administrator
Baseline the installed plugin inventory and flag deviations against the approved list

Monitoring Recommendations

Enable a WordPress activity logging plugin that records plugin installation, activation, and role changes with attributed user identity
Forward WordPress and web server logs to a centralized SIEM or data lake for retention and correlation
Monitor outbound HTTP connections from the web host to downloads.wordpress.org outside of maintenance windows

How to Mitigate CVE-2026-16576

Immediate Actions Required

Update the Dokan plugin to version 5.0.14 or later on all WordPress installations
Audit user accounts holding the Shop Manager role and revoke access for accounts no longer required
Review the installed plugin list and remove any plugin that cannot be attributed to an administrator action

Patch Information

The vendor addressed the flaw in Dokan version 5.0.14 by correcting the capability check on the affected admin REST API routes. Administrators should upgrade through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict WooCommerce management capabilities to trusted administrator accounts until the patch is applied
Use a WordPress hardening plugin or server configuration to disable plugin installation site-wide by setting DISALLOW_FILE_MODS to true in wp-config.php
Place the WordPress admin interface behind IP allowlisting or a web application firewall rule that blocks non-administrator access to Dokan admin REST routes

bash

# Configuration example: disable plugin installation in wp-config.php
define('DISALLOW_FILE_MODS', true);