Dokan Plugin Discount Coupon Ledger Miscalculation Vulnerability

Executive Summary

CVE-2026-107776 is a flaw in the Dokan WordPress plugin before version 5.3.3. It allows vendors to exploit the reverse withdrawal ledger by applying a discount coupon at checkout. The plugin fails to reconcile the credited amount in the ledger with the actual payment collected, enabling vendors to pay less than their outstanding commission debt.

Useful 0 Not Useful 0

Impact Analysis

If you are a vendor using the affected Dokan plugin versions, an attacker could exploit this to reduce their owed commission by paying less than the actual balance when using discount coupons. This could lead to financial losses for the vendor or platform. Users should update to version 5.3.3 or later to prevent exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves financial discrepancies in a WordPress plugin for vendor payments. However, improper handling of financial transactions could indirectly impact compliance if it leads to inaccurate financial records or disputes.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Dokan WordPress plugin to version 5.3.3 or later to address the vulnerability in the reverse withdrawal ledger system.

Useful 0 Not Useful 0