The vulnerability is an insecure direct object reference that occurs in multiple Dokan AJAX handlers. The handlers lack proper ownership validation and the nonce included in the requests only confirms a logged-in session, not ownership of the order. An authenticated vendor with Custom+ access can therefore manipulate any order: change its status, add actionable or customer‑visible notes, delete any note or comment, inject shipping tracking information, and grant or revoke download permissions. These modifications can trigger WooCommerce notification emails that reach customers, potentially causing confusion or financial impact.

The affected product is the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress, versions up to and including 5.0.3. Only installations running a vendor (Custom+) role, who can access the dashboard order pages, are susceptible.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path is at the vendor’s dashboard: the attacker logs in, harvests a nonce from their own order page, then submits an AJAX request replaying that nonce against a victim order ID. No additional privileges or code execution are required. The impact is limited to data integrity and potential customer communication issues, not remote code execution.