Dokan Plugin Unauthorized Download Access Vulnerability

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Dokan WordPress plugin before version 5.0.11. It occurs in an order REST endpoint where the system fails to verify if a downloadable product belongs to the requesting vendor before granting download permissions. This allows an authenticated vendor to give their customers free access to another vendor's paid downloadable files without authorization.

Useful 0 Not Useful 0

Detection Guidance

Check if your Dokan plugin version is below 5.0.11 by inspecting the plugin files or WordPress admin panel. Monitor network traffic for unauthorized download requests to order REST endpoints.

Useful 0 Not Useful 0

Impact Analysis

If you are a vendor using the affected plugin, an attacker with vendor access could exploit this to provide unauthorized free downloads of your paid files to their customers. This could lead to revenue loss and reputational damage. Customers might receive paid content without paying, undermining trust in your marketplace.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access to sensitive downloadable files. For GDPR, it may lead to unauthorized data exposure, while for HIPAA, it could compromise protected health information if such files are involved.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Dokan plugin to version 5.0.11 or later immediately. Review access logs for suspicious download activities and restrict vendor permissions if necessary.

Useful 0 Not Useful 0