CVE-2026-8761 Details

A privilege escalation vulnerability has been identified in the Dokan plugin for WordPress, affecting all versions through 5.0.1. The issue arises from a missing authorization check in the 'CustomersController' REST controller. This controller re-registers WooCommerce's customer CRUD routes under the '/dokan/v1/customers/' namespace, replacing the native 'manage_woocommerce' capability check with one that only inspects the requesting user's role. As a result, authenticated attackers with Vendor/Seller-level access can read, modify, or delete any WordPress user, including administrators, by sending 'GET', 'PUT', or 'DELETE' requests to '/wp-json/dokan/v1/customers/{id}'. Notably, changing the 'password' parameter for an administrator's account could lead to a complete takeover of the site.

Users are advised to update the Dokan plugin to version 5.0.3 or later, where this vulnerability has been patched.