Dok...plugin versions up to 5.0.4 contain an unauthenticated privilege escalation flaw. The defect allows an attacker to gain elevated privileges on a WordPress site running Dokan Pro without needing valid credentials. As a result, an attacker could perform any action that an administrator can, including modifying content, managing users, or installing additional plugins, which severely compromises confidentiality, integrity, and availability of the site.

The vulnerability affects the Dokan Multivendor Plugin: Dokan Pro for WordPress, specifically installations using version 5.0.4 or earlier.

The CVSS score of 9.8 reflects a high severity and the absence of an EPSS score indicates no current exploitation data is publicly available. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via an unauthenticated request to the plugin, making the attack vector likely network-based.