Dokan Plugin Reverse-Withdrawal Amount Manipulation

Executive Summary

This vulnerability affects the Dokan WordPress plugin before version 5.0.14. It involves a flaw in the reverse withdrawal ledger system where the plugin fails to validate the payment amount against the vendor's actual outstanding balance. This allows a vendor to manipulate the ledger by crediting an arbitrary amount, clearing their commission debt without making a real payment.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Dokan plugin version is below 5.0.14. Inspect the reverse-withdrawal ledger for unauthorized adjustments or arbitrary credit amounts that clear commission debts without payments.

Useful 0 Not Useful 0

Impact Analysis

A vendor could exploit this to avoid paying their commission debt by artificially inflating their reverse withdrawal ledger. This could lead to financial losses for the marketplace operator or other vendors if the debt remains unpaid.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Dokan plugin to version 5.0.14 or later immediately to patch the vulnerability. Review ledger entries for suspicious transactions and restrict vendor access to payment functions until updated.

Useful 0 Not Useful 0