Privilege Escalation in Dokan Pro WordPress Plugin

Executive Summary

The Dokan Pro plugin for WordPress has a vulnerability that allows privilege escalation through the update_capabilities REST Endpoint in all versions up to and including 5.0.4.

This happens because the update_capabilities() REST handler accepts arbitrary capability strings from the request body and passes them directly to WP_User::add_cap() without validating them against an allowlist.

The only check performed is that the caller has the dokandar capability.

As a result, authenticated attackers with Vendor-level access or higher on sites with the Vendor Staff module enabled can grant any WordPress capabilities, including administrator rights, to any vendor_staff account.

This can lead to a full site takeover.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows attackers with limited access (Vendor-level or above) to escalate their privileges arbitrarily.

Attackers can grant themselves or others administrator capabilities, effectively gaining full control over the WordPress site.

A full site takeover can lead to unauthorized data access, modification, deletion, or disruption of services.

It can also compromise the integrity and availability of the website and its data.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability affects all versions of the Dokan Pro plugin up to and including 5.0.4. Immediate mitigation steps include updating the Dokan Pro plugin to a version later than 5.0.4 where this issue is fixed.

Additionally, restrict access to the update_capabilities REST endpoint by limiting permissions or disabling the Vendor Staff module if it is not required, as the vulnerability requires this module to be enabled.

Monitor user roles and capabilities for unauthorized changes, especially for vendor_staff accounts, to detect any privilege escalation attempts.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated attackers with certain access to escalate privileges and potentially take over the entire WordPress site by granting arbitrary capabilities, including administrator rights.

Such a full site takeover could lead to unauthorized access to sensitive data, which may impact compliance with data protection regulations like GDPR and HIPAA by compromising confidentiality, integrity, and availability of personal or protected health information.

However, the provided information does not explicitly describe the direct effects on compliance with these standards or any mitigation steps related to regulatory requirements.

Useful 0 Not Useful 0