Unauthorized Vendor Commission Rate Disclosure in Dokan WooCommerce Plugin

Executive Summary

This vulnerability in the Dokan WordPress plugin before version 5.2.0 allows vendors to view commission rates and fixed fees set by the marketplace administrator for other vendors. It occurs because the plugin does not verify if the requesting vendor is the same as the vendor whose data is being accessed during commission calculations.

Useful 0 Not Useful 0

Detection Guidance

Check if your Dokan plugin version is below 5.2.0 by inspecting the plugin files or WordPress admin panel. Look for unauthorized access to commission rate or fixed fee data in server logs or database queries.

Useful 0 Not Useful 0

Impact Analysis

If you are a vendor using the affected plugin, another vendor could exploit this to learn your commission rate and fixed fee, potentially giving them an unfair advantage in pricing strategies. Marketplace administrators may also face reputational damage if sensitive financial data is exposed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR if personal or financial data of vendors is exposed without authorization. It may also violate data protection principles by failing to ensure confidentiality of sensitive business information.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Dokan plugin to version 5.2.0 or later immediately. If updating is not possible, restrict vendor access to sensitive commission data through additional access controls or plugin modifications.

Useful 0 Not Useful 0