The vulnerability is an insecure direct object reference that allows an authenticated attacker with vendor-level (custom+) privileges to change another customer's WordPress password via the 'password' parameter in the Dokan plugin REST API. By altering a customer’s password, the attacker can log in as that customer, effectively gaining limited account control. The weakness is identified as CWE‑639, reflecting an authorization bypass.

WordPress sites using the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin, versions up to and including 5.2.1, regardless of vendor registration settings. Any customer who has placed at least one order with a vendor who has custom or higher access is a potential target.

The CVSS score of 4.3 indicates a moderate severity for exploited impact. EPSS is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in CISA KEV. The most likely attack path is an authenticated user with vendor privileges performing a REST API call to /wp-json/dokan/v1/customers/{id} and supplying a new password. The limited scope of the attack—only customers with an order for that vendor—does not provide full system compromise but can be used to access sensitive account data or perform further fraud.