Dokan Plugin Unauthorized Order Data Access and Note Manipulation

Executive Summary

This vulnerability affects the Dokan WordPress plugin before version 5.3.3. It involves incorrect authorization checks in the Orders REST endpoint, allowing unauthenticated attackers to read customer and order information and manipulate order notes by adding or deleting them for certain orders.

Useful 0 Not Useful 0

Detection Guidance

Check if your WordPress site uses the Dokan plugin version prior to 5.3.3. Log in to your WordPress admin panel, go to Plugins, and verify the installed version. Alternatively, use WP-CLI with the command: wp plugin list --name=dokan. If the version is below 5.3.3, the site is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could access personally identifiable information (PII) of customers and order details. They may also add or delete order notes, potentially altering order records or injecting misleading information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive customer data, violating GDPR and HIPAA compliance requirements for data protection and privacy.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Dokan plugin to version 5.3.3 or later immediately. This can be done via the WordPress admin panel under Plugins or using WP-CLI with: wp plugin update dokan. Ensure backups are taken before updating. Monitor order notes and customer data for unauthorized changes after updating.

Useful 0 Not Useful 0