CVE-2026-16565 — Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

CVE-2026-16565

Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API PUBLISHED

Description (CNA)

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor's products on the marketplace.

Affected (CNA)

Vendor / product	Versions
Unknown / Dokan: AI Powered WooCommerce Multivendor Marketplace Solution	affected 0 before 5.0.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/82c341bb-64ad-45ee-9ac7-8d99927f0c0a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.