The Dokan Pro plugin for WordPress allows unauthenticated attackers to access the REST API endpoint /dokan/v1/wholesale/register without a capability check, enabling enumeration of users and retrieval of private data such as email addresses, usernames, display names, roles, and registration dates. This flaw permits a threat actor to collect user information without needing to log in, potentially facilitating phishing, credential stuffing, or privacy breaches. The key weakness is an access control issue, classified as CWE-862.

All installations of the Wedevs Dokan Pro plugin for WordPress up to and including version 4.1.3 are affected. The vulnerability is present in every release through 4.1.3 and is fixed in later versions; users of these plugins should verify the version number against the changelog.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an unauthenticated HTTP request to the vulnerable REST endpoint. An attacker can simply craft a GET or POST request that supplies a user ID, and the plugin will return the corresponding data without any authentication, making exploitation straightforward for online threat actor.