The Dokan Pro plugin for WordPress contains a flaw that allows an authenticated user with vendor-level or higher access to take over the account of any user, including site administrators. The vulnerability arises from the plugin failing to validate the identity of the user when processing a staff password reset, enabling unauthorized privilege escalation. This flaw is classified under CWE‑269 (Missing Authentication).

The affected product is the Dokan Pro plugin from wedevs, used within WordPress sites. Versions up to and including 4.0.5 are vulnerable. Administrators with vendor or higher roles can exploit the flaw, and by default the plugin permits customers to become vendors, potentially expanding the attack surface.

The severity score is CVSS 8.8, indicating high risk. The EPSS score is under 1%, so the likelihood of widespread exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, any authenticated attacker who has vendor or higher privileges can elevate their rights to staff level and reset the passwords of administrator accounts, potentially compromising the entire WordPress installation.