CVE-2026-16577 Overview
CVE-2026-16577 affects the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin in versions prior to 5.0.14. The plugin fails to validate a client-supplied payment amount against a vendor's actual outstanding balance when recording a reverse-withdrawal payment. A vendor with an authenticated account can credit their reverse-withdrawal ledger with an arbitrary value and clear their real commission debt without paying. The flaw is categorized under CWE-863: Incorrect Authorization.
Critical Impact
An authenticated vendor can manipulate ledger entries to erase commission debt owed to the marketplace operator, resulting in direct financial loss.
Affected Products
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin
- All versions prior to 5.0.14
- WordPress sites operating as WooCommerce multivendor marketplaces using Dokan
Discovery Timeline
- 2026-08-21 - CVE-2026-16577 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-16577
Vulnerability Analysis
The vulnerability is a business logic and authorization flaw in Dokan's reverse-withdrawal payment handler. Reverse withdrawal is the accounting mechanism Dokan uses when vendors collect payments directly from customers and owe commission back to the marketplace. When a vendor submits a payment record against their outstanding balance, the plugin trusts the amount value sent from the client without cross-checking it against the server-side ledger of what the vendor actually owes.
Because the server does not enforce the invariant that the payment amount must equal or be bounded by the vendor's real debt, a vendor can post an inflated or fabricated amount. The ledger then reflects the debt as satisfied even though no corresponding payment was received. The issue maps to CWE-863 because the plugin makes an authorization decision using unvalidated, attacker-controlled input.
Root Cause
The root cause is missing server-side validation of a security-sensitive numeric input. The payment recording endpoint accepts a vendor-supplied amount and writes it to the reverse-withdrawal ledger without comparing it to the authoritative outstanding balance held server-side. No integrity check, signed token, or recomputation is applied before the ledger is updated.
Attack Vector
Exploitation requires an authenticated vendor account on a marketplace running an affected version of Dokan. The vendor sends a crafted request to the reverse-withdrawal payment endpoint containing an arbitrary amount value. The plugin records the amount and marks the commission balance as cleared. No user interaction from the marketplace administrator is required, and no additional privileges are needed beyond a normal vendor role.
A verified proof-of-concept has not been published. For technical detail refer to the WPScan Vulnerability Advisory.
Detection Methods for CVE-2026-16577
Indicators of Compromise
- Reverse-withdrawal ledger entries where the recorded payment amount does not reconcile with any corresponding gateway transaction or bank deposit.
- Vendor accounts showing a rapid transition from a non-zero commission debt to a zero balance without an associated administrator-verified payment.
- Unusual HTTP POST activity to Dokan reverse-withdrawal payment endpoints originating from a single vendor session.
Detection Strategies
- Reconcile Dokan reverse-withdrawal ledger totals against external payment processor settlement reports on a scheduled basis.
- Enable WordPress and WooCommerce audit logging to capture the request bodies and user context of reverse-withdrawal transactions.
- Review database entries in the Dokan reverse-withdrawal tables for amounts that exceed known invoice values or that arrive outside of expected payment windows.
Monitoring Recommendations
- Alert on any reverse-withdrawal payment record created without a matching WooCommerce order or gateway transaction ID.
- Monitor Dokan plugin version across managed WordPress deployments and flag any instance below 5.0.14.
- Track vendor accounts whose cumulative reverse-withdrawal credits diverge from their commission accrual by more than a defined threshold.
How to Mitigate CVE-2026-16577
Immediate Actions Required
- Update the Dokan plugin to version 5.0.14 or later on every affected WordPress site.
- Audit the reverse-withdrawal ledger since the plugin was installed and identify entries that lack a corresponding gateway or bank record.
- Temporarily disable vendor-facing reverse-withdrawal payment recording until the update is applied if patching cannot occur immediately.
Patch Information
The vendor has released a fixed build in Dokan version 5.0.14. This release adds server-side validation so that a recorded reverse-withdrawal payment cannot exceed the vendor's actual outstanding balance. Administrators should apply the update through the WordPress plugin manager and verify the installed version afterward. Refer to the WPScan Vulnerability Advisory for advisory details.
Workarounds
- Restrict vendor role capabilities so that reverse-withdrawal payment submissions require administrator approval before the ledger is updated.
- Place a web application firewall rule in front of the Dokan reverse-withdrawal payment endpoint to inspect and constrain the amount parameter.
- Manually reconcile vendor commission balances against external payment records until the patched version is deployed.
# Verify installed Dokan plugin version on a WordPress host using WP-CLI
wp plugin get dokan-lite --field=version
wp plugin update dokan-lite --version=5.0.14
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
