Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-16576

Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

Default version status: unaffected

  • 0 to < 5.0.14affected

References