CVE-2026-8761: Dokan WordPress Privilege Escalation Flaw

CVE-2026-8761 Overview

The Dokan multivendor plugin for WordPress contains a missing authorization vulnerability in its REST API implementation. All versions up to and including 5.0.1 are affected. The flaw resides in the CustomersController REST controller at includes/REST/CustomersController.php, which re-registers WooCommerce customer CRUD routes under the /dokan/v1/customers/ namespace. The plugin replaces WooCommerce's native manage_woocommerce capability check with a vendor-only check that inspects the requesting user's role without validating the target user. Authenticated attackers with Vendor or Seller-level access can read, modify, or delete any WordPress user, including administrators.

Critical Impact
Setting the password parameter on an administrator's record via the vulnerable REST endpoint yields a full site takeover.

Affected Products

Dokan plugin for WordPress (dokan-lite), all versions through 5.0.1
Fixed in Dokan version 5.0.3
WordPress sites operating multivendor marketplaces with Vendor/Seller-level user roles

Discovery Timeline

2026-08-05 - CVE CVE-2026-8761 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-8761

Vulnerability Analysis

The vulnerability is a missing authorization flaw classified under [CWE-862]. Dokan's CustomersController re-implements WooCommerce's customer REST endpoints under the /wp-json/dokan/v1/customers/{id} namespace. WooCommerce enforces the manage_woocommerce capability on these routes, which restricts access to administrative users. Dokan replaces that check with a permission callback that only verifies whether the requesting user holds a vendor or seller role.

The permission callback never inspects the {id} parameter or the role of the target user. Any authenticated vendor can therefore issue GET, PUT, or DELETE requests against arbitrary WordPress user IDs, including administrator accounts. The endpoints expose full CRUD semantics inherited from WooCommerce's customer schema, including the password field.

Root Cause

The root cause is an authorization model that validates the caller's role but omits target-object authorization. In CustomersController.php, the get_item_permissions_check, update_item_permissions_check, and delete_item_permissions_check methods return true when the requester is a vendor, without checking whether the target user is within the vendor's authorized scope. The re-registration of WooCommerce routes bypasses the original manage_woocommerce capability gate.

Attack Vector

An authenticated attacker registers or compromises a Vendor/Seller account on the target WordPress site. The attacker enumerates user IDs, then issues a PUT request to /wp-json/dokan/v1/customers/1 with a JSON body containing a new password value. WordPress user ID 1 is typically the site administrator. The attacker then authenticates as the administrator using the new credentials and executes arbitrary actions, including plugin uploads for code execution. See the Wordfence Vulnerability Report for additional technical detail.

No verified exploit code has been published. The vulnerable code paths can be reviewed in the WordPress Dokan REST API Code.

Detection Methods for CVE-2026-8761

Indicators of Compromise

Unexpected PUT or DELETE requests to /wp-json/dokan/v1/customers/{id} targeting low-numbered user IDs, especially ID 1
WordPress administrator accounts with recent user_pass changes that do not correlate with password reset events in the audit log
New administrator or editor accounts created shortly after vendor account activity
Unexpected plugin or theme uploads following suspicious REST API traffic

Detection Strategies

Monitor web server access logs for authenticated requests to the /wp-json/dokan/v1/customers/ namespace from users without the manage_woocommerce capability
Correlate WordPress user_meta and users table modifications with the source REST endpoint recorded in application logs
Alert on any REST API request body containing a password field directed at Dokan customer routes

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and forward logs to a centralized SIEM for retention and correlation
Baseline normal vendor activity and alert on deviations, particularly requests targeting user IDs outside the vendor's own record
Track plugin version inventory across WordPress fleets to identify hosts running Dokan versions at or below 5.0.1

How to Mitigate CVE-2026-8761

Immediate Actions Required

Upgrade the Dokan plugin to version 5.0.3 or later on all affected WordPress installations
Audit all administrator and privileged accounts for unauthorized password changes and remove any unknown accounts
Rotate credentials for all administrator accounts and enforce multi-factor authentication
Review recent vendor account registrations for signs of abuse and disable suspicious accounts

Patch Information

The vendor released a fix in Dokan version 5.0.3. The WordPress Dokan Version Change diff shows the corrected permission checks in CustomersController.php. Apply the update through the WordPress plugin manager or by deploying the updated plugin package.

Workarounds

If immediate patching is not possible, disable the Dokan plugin until the upgrade can be applied
Restrict access to the /wp-json/dokan/v1/customers/ route at the web server or WAF layer to trusted IP ranges
Temporarily remove the Vendor and Seller roles from untrusted users to limit the attacker population

bash

# Example nginx block to restrict the vulnerable REST namespace
location ~ ^/wp-json/dokan/v1/customers/ {
    allow 10.0.0.0/8;
    deny all;
}