CVE-2026-107774 Details
Description
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.
A vulnerability exists in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin, affecting versions prior to 5.3.3. The issue arises because the plugin does not use a trusted site-owned sender address when relaying store contact form messages. Instead, it places the unauthenticated submitter's email address directly in the From header, rather than using a Reply-To header. This flaw allows unauthenticated attackers to spoof the sender's address to one at the site's domain, such as the administrator's email, taking advantage of the domain's SPF and DKIM settings. As a result, emails can be sent to vendors that appear to come from a legitimate source.
Users are advised to update the Dokan WooCommerce Multivendor Marketplace Solution WordPress plugin to version 5.3.3 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/1d1d7ba1-9c69-47b2-beb4-ed02066cb02b/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Dokan | < 5.3.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 5, 2026 | New CVE Received | [email protected] |