The Dokan plugin before version 5.0.14 records reverse‑withdrawal payments without checking the amount against the vendor’s actual outstanding balance. This flaw lets a vendor credit their reverse‑withdrawal ledger with any arbitrary amount, effectively wiping out commission debt without providing payment. The consequence is financial fraud against the platform, compromising the integrity of vendor settlements. This deficit results from improper validation of client‑supplied data—an access control failure reflected in CWE‑285 and a failure to enforce input constraints reflected in CWE‑398.

The vulnerability affects any installation of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution on WordPress that uses a version prior to 5.0.14. No specific build numbers are listed beyond the major release cutoff.

Because the flaw is triggered by client‑supplied data within an already trusted vendor context, a malicious vendor can exploit it immediately without needing code execution or remote access. The EPSS score is unavailable and the vulnerability is not listed in CISA KEV, but the financial impact is high. The CVSS score is not provided, yet the risk remains significant for platforms relying on Dokan for commission settlement.