The Dokan plugin for WordPress contains a missing authorization verification in its REST controller that redefines WooCommerce’s customer routes. The control incorrectly checks only the requesting user’s role and never validates the target user, enabling an authenticated user with a Vendor or higher role to read, modify, or delete any WordPress user record—including administrators. Changing an administrator’s password through the exposed endpoint grants a full site takeover. This flaw is a direct abuse of the elevation of privilege weakness (CWE-862).

Any WordPress site running Dokan v5.0.1 or earlier is affected. The vulnerability applies to all instances where the plugin’s REST API is enabled and accessible, regardless of site configuration or additional security plugins.

The flaw is rated with a CVSS score of 8.8, classifying it as High severity. No EPSS score is currently available, but the lack of KEV listing does not diminish the risk for installations still running vulnerable versions. The attack vector is via the exposed REST endpoints and requires only authenticated access with vendor or higher privileges, making it relatively easy for an insider or compromised vendor account to exploit. Successful exploitation yields full control over the site, allowing arbitrary user manipulation and account takeover.