The vulnerability in the Dokan WordPress plugin lies in its failure to reconcile the amount credited to a vendor's reverse‑withdrawal ledger with the amount actually collected for a payment order. When a discount coupon is applied at checkout, the plugin allows a vendor to clear their outstanding commission debt while paying less than the balance owed. This logical flaw can result in financial loss for the marketplace operator or end customers, as commissions may be credited without the corresponding funds being held. The weakness is essentially a business‑logic failure, preventing proper accounting of vendor payouts.

All installations of the Dokan plugin for WordPress that run any version earlier than 5.3.3 are affected. The vendor is Dokan and the product is the Dokan marketplace plugin. No specific vendor‑maintained naming beyond the plugin itself is supplied. Any site using an older Dokan release is potentially vulnerable.

The CVSS base score of 2.2 indicates low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is internal; it would require a vendor or marketplace administrator to trigger a withdrawal while a discount coupon is applied, and the system would credit the ledger incorrectly. Because the flaw is tied to the plugin’s accounting routine, it is not remotely exploitable by an external actor without access to vendor accounts or the ability to create discount coupons. Nevertheless, the financial implications for the marketplace could be material.