CVE-2026-66699

Deferred Deferred - Pending Action

Dokan Plugin Broken Access Control Vulnerability

Publication date: 2026-08-06

Last updated on: 2026-10-24

Assigner: Patchstack

Description

Custom role Broken Access Control in Dokan <= 5.0.10 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-10-24

Generated

2026-11-08

AI Q&A

2026-08-06

EPSS Evaluated

2026-11-07

NVD

CVE-2026-66699

EUVD

EUVD-2026-53904

Affected Vendors & Products

Vendor	Product	Version / Range
wedevs	dokan	to 5.0.10 (inc)
wedevs	dokan	5.0.11

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is a Broken Access Control vulnerability in the WordPress Dokan Plugin versions 5.0.10 and below. It allows unprivileged users to perform actions that require higher privileges due to missing authorization, authentication, or nonce token checks.

Detection Guidance

To detect this vulnerability, check the installed version of the Dokan plugin in your WordPress site. If it is version 5.0.10 or below, it is vulnerable. You can verify the version via the WordPress admin panel under Plugins or by inspecting the plugin files on the server.

Impact Analysis

An attacker could exploit this to perform unauthorized actions on your WordPress site, potentially modifying settings, accessing sensitive data, or taking control of parts of the site without proper permissions.

Compliance Impact

This vulnerability allows unprivileged users to perform higher-privileged actions due to missing authorization checks. While not directly stated, such access control flaws could potentially lead to unauthorized data exposure or modification, which may violate compliance requirements under GDPR (data protection) or HIPAA (health data privacy) if exploited.

Mitigation Strategies

Immediately update the Dokan plugin to version 5.0.11 or later. If updating is not possible, disable the plugin temporarily or seek assistance from your hosting provider or developer. Enable auto-updates for vulnerable plugins if using Patchstack.

Hi! I’m here to help you understand CVE-2026-66699. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...