CVE-2026-16575
Received Received - Intake

Unauthenticated Access to Vendor Commission Data in Dokan Plugin

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: WPScan

Description
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-16575
EUVD
EUVD-2026-63817

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpdev dokan to 5.0.14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Dokan WordPress plugin before version 5.0.14. It involves an unauthenticated store REST endpoint that exposes per-vendor commission settings. Unauthenticated users can access sensitive commission data, including commission types and rates if category-based commission is configured.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Dokan plugin version prior to 5.0.14. You can inspect the plugin version via the WordPress admin panel or by examining the plugin files. Use the REST endpoint /wp-json/wc/v3/dokan/store-categories to see if it exposes commission details without authentication.

Impact Analysis

An attacker could exploit this to disclose confidential commission details of vendors using the plugin. This may lead to financial data exposure, competitive disadvantages, or reputational harm for affected vendors. The vulnerability does not allow modification of data, only unauthorized access.

Compliance Impact

This vulnerability could violate GDPR if personal or financial data is exposed without authorization. It may also conflict with HIPAA if health-related vendor data is involved. Organizations must ensure compliance by updating the plugin to mitigate data disclosure risks.

Mitigation Strategies

Immediately update the Dokan plugin to version 5.0.14 or later. If updating is not possible, consider disabling the plugin temporarily until the update is applied. Review server logs for unauthorized access attempts to the /wp-json/wc/v3/dokan/store-categories endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16575. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart