The Dokan "AI Powered WooCommerce Multivendor Marketplace Solution" plugin for WordPress fails to verify the precise user capability on several admin REST API routes. Rather than checking the dedicated Dokan installation capability, the system only verifies a generic WooCommerce management right. This oversight permits users with the Shop Manager role to issue a REST request that instructs WordPress to download and activate any plugin from WordPress.org. An attacker can therefore inject a malicious plugin that may contain backdoors, exfiltration code, or additional exploits. The flaw constitutes a privilege escalation that ultimately enables arbitrary code execution and significant loss of integrity and confidentiality for the affected WordPress installation.

WordPress sites that have the Dokan "AI Powered WooCommerce Multivendor Marketplace Solution" plugin installed at any version prior to 5.0.14 and where a Shop Manager (or a similar role with WooCommerce management capability) exists. All sites that have not applied the 5.0.14 or later update are exposed, regardless of other security controls.

While the CVSS score is not provided and the EPSS is unavailable, the vulnerability allows authenticated attackers to exploit a REST endpoint that is publicly accessible to a user with sufficient privileges. The required effort is low if a Shop Manager account is present, and the impact is high, enabling arbitrary plugin installation and execution. No KEV listing or known exploitation references are reported, but the attack vector is clear and the consequence severe. The immediate risk therefore lies in the combination of privilege escalation and the ability to execute arbitrary code on the host.