CVE-2026-16574 Dokan CVE debrief

Who should care

Users of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin, especially those with paid downloadable products, should be aware of this vulnerability and take steps to protect their sites. This includes updating to version 5.0.11 or later, restricting access to downloadable products based on vendor and customer permissions, and monitoring for suspicious activity related to downloadable files. Additionally, vendors should review their product offerings and ensure that they are not inadvertently providing free access to their paid downloadable files. Security teams should also be aware of this vulnerability and monitor for potential attacks.

Technical summary

The Dokan plugin before version 5.0.11 does not properly verify downloadable product ownership before granting access through its order REST endpoints. This allows an authenticated vendor to provide their customers with free access to another vendor's paid downloadable files. The vulnerability is caused by a lack of proper verification of downloadable product ownership, which could lead to unauthorized access and potential financial losses for vendors. To exploit this vulnerability, an authenticated vendor would need to have access to the order REST endpoints and be able to manipulate the product ownership information.

Defensive priority

Medium priority due to potential for unauthorized access to paid downloadable files.

Recommended defensive actions

• Verify Dokan plugin version and update to 5.0.11 or later
• Restrict access to downloadable products based on vendor and customer permissions
• Monitor for suspicious activity related to downloadable files
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files. Evidence from WPScan indicates a vulnerability in the Dokan plugin. Official CVE and NVD records provide additional context. The vulnerability allows an authenticated vendor to provide their customers with free access to another vendor's paid downloadable files. This could lead to unauthorized access and potential financial losses for vendors. Defenders should verify the version of the Dokan plugin and update to 5.0.11 or later. They should also restrict access to downloadable products based on vendor and customer permissions and monitor for suspicious activity related to downloadable files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.