CVE-2026-16574 — Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint

CVE-2026-16574

Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint PUBLISHED

Description (CNA)

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.

Affected (CNA)

Vendor / product	Versions
Unknown / Dokan: AI Powered WooCommerce Multivendor Marketplace Solution	affected 0 before 5.0.11

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b38dc6a4-a590-402f-88e1-3624a22c7348/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.