Dokan Plugin Bulk Order Status Modification Vulnerability

Executive Summary

This vulnerability affects the Dokan WordPress plugin, which is used for creating multi-vendor marketplaces. The flaw allows vendors to change the status of any WooCommerce order on the site without verifying ownership. This means a vendor could modify orders belonging to other vendors or customers, potentially causing confusion or fraud.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized bulk order-status changes in WooCommerce logs. Review REST API requests to the affected endpoint. Look for vendor accounts performing actions outside their assigned orders.

Useful 0 Not Useful 0

Impact Analysis

If you are a vendor using this plugin, an attacker with a vendor account could alter your orders, leading to financial loss or reputational damage. If you are a customer, your order status could be changed without your knowledge, affecting your purchases. Store owners may face operational disruptions or trust issues.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or sensitive order data. GDPR requires protecting personal data, and HIPAA mandates securing health-related transactions. Unauthorized order changes may violate these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Dokan plugin to version 5.0.9 or later immediately. Restrict vendor permissions to prevent bulk order modifications. Monitor order status changes for suspicious activity.

Useful 0 Not Useful 0