CVE-2026-16575 Dokan CVE debrief

Who should care

Organizations using the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin should be aware of this vulnerability and take steps to prevent unauthorized disclosure of vendor commission configurations. This includes verifying that they are using version 5.0.14 or later and restricting access to sensitive vendor commission configurations. Security teams and vulnerability management teams should prioritize this vulnerability and review their asset inventory for exposed systems.

Technical summary

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints. This allows any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates. The vulnerability affects the plugin's handling of vendor commission configurations.

Defensive priority

Organizations using the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin should verify that they are using version 5.0.14 or later to prevent unauthorized disclosure of vendor commission configurations.

Recommended defensive actions

• Verify that the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin is updated to version 5.0.14 or later.
• Restrict access to sensitive vendor commission configurations.
• Monitor for potential unauthorized access to vendor commission information.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is needed to determine the full scope of the vulnerability and potential impact. The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates. Organizations should verify the plugin version and review their configurations.

Official resources