CVE-2026-8761 dokaninc CVE debrief

Who should care

WordPress users with the Dokan plugin installed, particularly those with Vendor/Seller-level access or above, should be aware of this vulnerability and take immediate action to patch or mitigate it.

Technical summary

The Dokan plugin for WordPress is vulnerable to Privilege Escalation due to a missing authorization check in the `CustomersController` REST controller (`includes/REST/CustomersController.php`). This allows authenticated attackers with Vendor/Seller-level access and above to read, modify, or delete any WordPress user, including administrators, via `GET`/`PUT`/`DELETE` requests against `/wp-json/dokan/v1/customers/{id}`. Setting the `password` parameter on an administrator's record yields a full site takeover. The vulnerability is caused by a missing authorization check in the `CustomersController` REST controller. The controller re-registers WooCommerce's customer CRUD routes under the `/dokan/v1/customers/` namespace and replaces WooCommerce's native `manage_woocommerce` capability check with a vendor-only check that inspects the requesting user's role and never validates the target user. This makes it possible for authenticated attackers with Vendor/Seller-level access and above to read, modify, or delete any WordPress user — including administrators — via `GET`/`PUT`/`DELETE` requests against `/wp-json/dokan/v1/customers/{id}`. Setting the `password` parameter on an administrator's record yields a full site takeover. To mitigate this vulnerability, users should apply the latest patch or update to version 5.0.2 or later, restrict access to the `/wp-json/dokan/v1/customers/` namespace, and monitor for suspicious activity on the `/wp-json/dokan/v1/customers/` namespace. Additionally, implementing additional security measures to prevent privilege escalation attacks is recommended. The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the `CustomersController` REST controller, which re-registers WooCommerce's customer CRUD routes under the `/dokan/v1/customers/` namespace and replaces WooCommerce's native `manage_woocommerce` capability check with a vendor-only check that inspects the requesting user's role and never validates the target user. This makes it possible for authenticated attackers with Vendor/Seller-level access and above to read, modify, or via

Defensive priority

High priority due to the high CVSS score of 8.8 and the potential for full site takeover.

Recommended defensive actions

• Apply the latest patch or update to version 5.0.2 or later
• Restrict access to the `/wp-json/dokan/v1/customers/` namespace
• Monitor for suspicious activity on the `/wp-json/dokan/v1/customers/` namespace
• Implement additional security measures to prevent privilege escalation attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by a missing authorization check in the `CustomersController` REST controller. The controller re-registers WooCommerce's customer CRUD routes under the `/dokan/v1/customers/` namespace and replaces WooCommerce's native `manage_woocommerce` capability check with a vendor-only check. This allows authenticated attackers with Vendor/Seller-level access and above to read, modify, or delete any WordPress user, including administrators.

Official resources