CVE-2026-16577

Deferred Deferred - Pending Action

Dokan Plugin Reverse-Withdrawal Amount Manipulation

Publication date: 2026-08-21

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal ledger with an arbitrary amount and clear their real commission debt without paying.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-26

Generated

2026-09-10

AI Q&A

2026-08-21

EPSS Evaluated

2026-09-09

NVD

CVE-2026-16577

EUVD

EUVD-2026-63819

Affected Vendors & Products

Vendor	Product	Version / Range
wpdev	dokan	to 5.0.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Dokan WordPress plugin before version 5.0.14. It involves a flaw in the reverse withdrawal ledger system where the plugin fails to validate the payment amount against the vendor's actual outstanding balance. This allows a vendor to manipulate the ledger by crediting an arbitrary amount, clearing their commission debt without making a real payment.

Detection Guidance

To detect this vulnerability, check if your Dokan plugin version is below 5.0.14. Inspect the reverse-withdrawal ledger for unauthorized adjustments or arbitrary credit amounts that clear commission debts without payments.

Impact Analysis

A vendor could exploit this to avoid paying their commission debt by artificially inflating their reverse withdrawal ledger. This could lead to financial losses for the marketplace operator or other vendors if the debt remains unpaid.

Compliance Impact

This vulnerability could potentially affect compliance with financial regulations and data integrity standards by allowing vendors to manipulate payment records without actual transactions. This undermines accurate financial reporting and audit trails, which may conflict with requirements for transparency and accountability in standards like GDPR (data accuracy principles) and HIPAA (financial record integrity).

Mitigation Strategies

Update the Dokan plugin to version 5.0.14 or later immediately to patch the vulnerability. Review ledger entries for suspicious transactions and restrict vendor access to payment functions until updated.

Hi! I’m here to help you understand CVE-2026-16577. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70