CVE-2025-14977
IDOR Vulnerability in Dokan Plugin Allows Payment Data Theft
Publication date: 2026-01-20
Last updated on: 2026-01-20
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wedevs | dokan_lite | to 4.2.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Insecure Direct Object Reference (IDOR) in the Dokan AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress, affecting versions up to and including 4.2.4. It occurs via the `/wp-json/dokan/v1/settings` REST API endpoint due to missing validation on a user-controlled key. This flaw allows authenticated attackers with customer-level permissions or higher to access or modify other vendors' store settings, including sensitive payment information such as PayPal emails, bank account details, routing numbers, IBAN, SWIFT codes, phone numbers, and addresses. Attackers can also change PayPal email addresses to their own, enabling financial theft during marketplace payout processing.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure and modification of sensitive vendor information, including payment details and contact information. Attackers with customer-level access can read or alter other vendors' store settings, potentially redirecting payments to attacker-controlled accounts. This can result in financial theft, loss of trust, and disruption of marketplace operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your WordPress installation is running the Dokan Lite plugin version 4.2.4 or earlier. Specifically, monitoring or testing access to the `/wp-json/dokan/v1/settings` REST API endpoint for unauthorized access or modification attempts can help detect exploitation. Since the vulnerability involves authenticated users with customer-level permissions or above accessing or modifying other vendors' store settings, you can audit REST API requests to this endpoint for suspicious activity. Commands to check plugin version via WP-CLI: `wp plugin get dokan-lite --field=version`. To monitor REST API requests, you can use web server logs or tools like `curl` to test access, e.g.: `curl -X GET https://yourdomain.com/wp-json/dokan/v1/settings?vendor_id=some_id -H 'Authorization: Bearer <token>'` to see if you can access other vendors' settings. However, no specific detection commands are provided in the resources. [3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Dokan Lite plugin to a version later than 4.2.4 where this vulnerability is fixed. Since the vulnerability allows authenticated users with customer-level permissions and above to read or modify other vendors' sensitive store settings, restricting access to the `/wp-json/dokan/v1/settings` REST API endpoint and ensuring proper validation of user-controlled keys is critical. If an update is not immediately possible, consider temporarily disabling the Dokan Lite plugin or restricting REST API access to trusted users only. Monitoring and auditing REST API usage for suspicious activity is also recommended. [2, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated attackers with customer-level permissions to access and modify other vendors' sensitive store settings, including payment information and personal contact details. Such unauthorized access and modification of sensitive personal and financial data can lead to violations of data protection regulations like GDPR and HIPAA, which mandate strict controls over personal data confidentiality and integrity. Therefore, exploitation of this vulnerability could result in non-compliance with these standards due to data breaches and unauthorized data manipulation.