CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2026-8761: The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the `CustomersCont

highCVSS 8.8CVE-2026-8761
The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the CustomersController REST controller (includes/REST/CustomersController.php), which re-registers WooCommerce's customer CRUD routes under the /dokan/v1/customers/ namespace and replaces WooCommerce's native manage_woocommerce capability check with a vendor-only check that inspects the requesting user's role and never validates the target user. This makes it possible for authenticated attackers with Vendor/Seller-level access and above to read, modify, or delete any WordPress user — including administrators — via GET/PUT/DELETE requests against /wp-json/dokan/v1/customers/{id}. Setting the password parameter on an administrator's record yields a full site takeover.

Details

Source
NVD Recent CVEs (US · database · site)
Severity
high — CVSS 8.8
Published
2026-08-05
Last updated
2026-08-05
Exploitation
Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-8761

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-8761coverage & exploitation statusNVD · CVE.org

Recent advisories for Dokan plugin for

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from NVD Recent CVEs