CVE-2026-16564 — Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint

CVE-2026-16564

Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint PUBLISHED

Description (CNA)

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk order-status changes, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace, including orders belonging to other vendors and the store's own customers.

Affected (CNA)

Vendor / product	Versions
Unknown / Dokan: AI Powered WooCommerce Multivendor Marketplace Solution	affected 0 before 5.0.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/293f5040-5831-483a-9e63-cbbcb3e7d28f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.