CVE-2026-107775lowCWE-863

CVE-2026-107775: falha de baixa gravidade em Dokan: AI Powered WooCommerce Multivendor…

Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 2.7epss 0.2%
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Unknown · Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Dokan: AI Powered WooCommerce Multivendor…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-16576HIGHDokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST APIEPSS 0.5%CVE-2026-16575MEDIUMDokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST EndpointEPSS 0.3%CVE-2026-16577LOWDokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied AmountEPSS 0.3%CVE-2026-16565MEDIUMDokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST APIEPSS 0.3%CVE-2026-16564MEDIUMDokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST EndpointEPSS 0.3%CVE-2026-107694LOWDokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST EndpointEPSS 0.2%