Executive Summary

The vulnerability in the Dokan Pro plugin for WordPress allows an authenticated attacker with vendor-level access or higher to escalate their privileges by taking over accounts. This happens because the plugin does not properly verify a user's identity before allowing a password reset for staff members. As a result, the attacker can change passwords of arbitrary users, including administrators, thereby gaining unauthorized access to their accounts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized privilege escalation, allowing attackers to gain access to staff or administrator accounts. This can result in loss of control over the WordPress site, unauthorized changes, data breaches, and potential further exploitation of the system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the Dokan Pro plugin to a version later than 4.0.5 where the issue is fixed. Additionally, review and restrict vendor-level access permissions to trusted users only, and monitor for any unauthorized password changes, especially for staff and administrator accounts.

Useful 0 Not Useful 0