Dokan Plugin Unauthorized Seller Role Assignment

Executive Summary

This vulnerability is an authorization issue in the Dokan plugin for WordPress. It allows a subsite administrator on a WordPress Multisite network to enable marketplace seller status for users outside their own subsite, including network-level users they cannot manage. The plugin fails to verify if the administrator has permission to manage the selected users before granting seller access.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the Dokan plugin in WordPress. If it is below 5.3.3, the system is vulnerable. Use WordPress admin panel or run SQL query: SELECT * FROM wp_options WHERE option_name LIKE '%dokan_version%';

Review user roles and permissions in WordPress Multisite. Look for unauthorized seller status assignments across subsites.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized users to gain seller privileges on your WordPress Multisite network. A subsite administrator might elevate users they shouldn't have access to, potentially leading to unauthorized sales activities or misuse of the marketplace functionality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to user data. If an administrator on a WordPress Multisite network can enable seller status for users outside their subsite, it may lead to improper data handling or unauthorized modifications to user roles, violating data protection and access control requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Dokan plugin to version 5.3.3 or later immediately. Disable the plugin temporarily if an update is not immediately possible.

Audit user roles and seller permissions across all subsites. Remove unauthorized seller status assignments.

Monitor for suspicious activity related to user role changes or seller status modifications.

Useful 0 Not Useful 0