CVE-2026-107776 Details
Description
The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.
A vulnerability exists in the Dokan WordPress plugin in versions prior to 5.3.3. The issue arises because the plugin fails to properly reconcile the amount credited to a vendor's reverse-withdrawal ledger with the actual amount collected for the payment order. This oversight allows vendors to reduce their outstanding commission debt while paying less than the total owed, particularly when a discount coupon is used at checkout.
Users are advised to update the Dokan WordPress plugin to version 5.3.3 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/e34bdc0e-0e33-4ffd-8edb-fef726259e04/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Dokan | < 5.3.3 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | New CVE Received | [email protected] |