CVE-2026-16576

Deferred Deferred - Pending Action

Privilege Escalation in Dokan Multivendor Marketplace

Publication date: 2026-08-21

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-26

Generated

2026-09-10

AI Q&A

2026-08-21

EPSS Evaluated

2026-09-09

NVD

CVE-2026-16576

EUVD

EUVD-2026-63818

Affected Vendors & Products

Vendor	Product	Version / Range
wpdev	dokan	to 5.0.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

CVE-2026-16576 is a vulnerability in the Dokan plugin for WordPress versions before 5.0.14. It involves improper access control in certain admin REST API routes where the plugin checks for a WooCommerce management capability instead of the required plugin-installation capability. This allows users with Shop Manager roles or higher to install and activate arbitrary plugins from WordPress.org.

Detection Guidance

Check the installed version of the Dokan plugin in your WordPress admin panel under Plugins. If the version is below 5.0.14, the system is vulnerable. Use WP-CLI with the command 'wp plugin list' to verify versions across installations.

Impact Analysis

This vulnerability allows unauthorized users with Shop Manager roles to install and activate arbitrary plugins. This could lead to malicious plugins being installed, potentially compromising the entire WordPress site, stealing data, or gaining unauthorized access.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized users to install arbitrary plugins. Unauthorized plugin installations may introduce additional security risks, data breaches, or non-compliance with data protection requirements if malicious or vulnerable plugins are activated.

Mitigation Strategies

Update the Dokan plugin to version 5.0.14 or later immediately. Remove unnecessary user roles like Shop Manager if they are not required. Monitor for unauthorized plugin installations in the WordPress admin panel.

Hi! I’m here to help you understand CVE-2026-16576. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70