The Dokan AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin, in all releases prior to 5.0.9, allows a vendor to use its product-attribute REST write endpoints without verifying that the vendor owns the target product. This flaw enables a vendor to change the attributes and default attributes of any other vendor’s products, subtly or dramatically altering product listings, prices, or availability. The impact is a loss of data integrity and potential financial harm in a marketplace with multiple vendors, since unauthorized changes can affect earnings, reviews, and customer trust.

Any WordPress site that has installed the Dokan plugin in a version earlier than 5.0.9 is directly affected. The vulnerability applies to all vendors of the marketplace who have standard vendor accounts providing access to the product-attribute REST API.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the flaw is exploitable through the publicly documented REST API once a vendor account has been created. An attacker would need only legitimate API credentials and the ability to target another vendor’s product ID. Because the vulnerability enables unauthorized write access, the risk to the integrity of the marketplace is high, and the CVSS score of 4.3 indicates a moderate severity. The attack vector is inferred to be remote, authenticated via the API, relying on the absence of ownership checks.