CVE-2026-107774: vulnerability in Dokan: AI Powered WooCommerce Multivendor…
Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
23Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 0.1%
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.
public PoCs found — 1
cve_referencewpscan.com/vulnerability/1d1d7ba1-9c69-47b2-beb4-ed02066cb02b/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Dokan: AI Powered WooCommerce Multivendor…
In the same product, most dangerous first.
CVE-2026-16576HIGHDokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST APIEPSS 0.5%CVE-2026-16575MEDIUMDokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST EndpointEPSS 0.3%CVE-2026-16577LOWDokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied AmountEPSS 0.3%CVE-2026-16565MEDIUMDokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST APIEPSS 0.3%CVE-2026-16564MEDIUMDokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST EndpointEPSS 0.3%CVE-2026-107694LOWDokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST EndpointEPSS 0.2%