The Dokan WordPress plugin before version 5.2.0 contains an access control flaw that allows any vendor to request commission data for other vendors. By calling the commission REST endpoint without proper verification, attackers can reveal the marketplace administrator‑configured commission rate and fixed fee for other vendors, compromising confidential financial information.

Any installation of Dokan: AI Powered WooCommerce Multivendor Marketplace Solution running a version earlier than 5.2.0 is affected. The vulnerability appears in the plugin’s commission calculation endpoint exposed via WordPress REST API. No additional vendor or product variants are reported, and the affected version range is unspecified beyond the stated <5.2.0 limit.

The vulnerability is exploitable by any authenticated vendor who has access to the REST endpoint, which is typically the case for registered sellers in the marketplace. Based on the description, it is inferred that the commission REST endpoint is reachable over HTTP and can be invoked by any vendor who has authenticated credentials. The lack of a verification step makes the attack trivial once the endpoint is reached, resulting in immediate disclosure of sensitive data. The CVSS score is 2.7, the EPSS score is not available, and the vulnerability is not listed in CISA‑KEV, indicating no known large‑scale exploitation, yet the risk remains high due to the sensitive nature of the exposed data.