The Dokan WordPress plugin before version 5.0.9 does not verify that the user making a request to the /orders/bulk‑actions REST endpoint actually owns or is authorized to modify the specified orders. As a result, any authenticated Dokan vendor can change the status of orders belonging to other vendors, the marketplace administrator, or customers. This leads to unauthorized alterations of order data and violates proper authorization (CWE‑639).

All WordPress sites using the Dokan AI Powered WooCommerce Multivendor Marketplace Solution plugin with a version older than 5.0.9. The vulnerability is present in all builds prior to the 5.0.9 release, regardless of the number of vendors installed or the configuration of WooCommerce. It does not affect external visitors; only users with a Dokan vendor role and valid authentication can exploit it.

The vulnerability is exploited through authenticated requests to the /orders/bulk-actions REST endpoint. No special conditions beyond having a Dokan vendor account are required. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, so there is no public evidence of exploitation yet. The CVSS base score is 4.3, indicating a moderate severity. Because the endpoint accepts bulk actions, a single request could affect many orders, increasing the potential damage.