{"id":"CVE-2026-107773","kind":"vulnerability","aliases":["CVE-2026-107773"],"related":[],"title":"Dokan WooCommerce marketplace plugin lets strangers read and edit order notes","description":"The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.","summary":"The Dokan WordPress plugin before 5.3.3 does not check authorization when it serves a single order and its order notes. An unauthenticated attacker can read customer and order details and add or delete order notes for some orders.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dokan","package","self-hosted","woocommerce","wordpress"],"not_affected_if":["version-5.3.3-or-later"],"how_to_check":"- Check the installed Dokan version in the WordPress admin plugin list or in the plugin's main file header, looking for a version below `5.3.3`.\n- Confirm the Dokan plugin is active on the WooCommerce store.","fix":"- Dokan (WordPress plugin): update to `5.3.3` or later.","status":"open","published_at":"2026-11-05T06:17:06+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","triaged_at":"2026-11-05T06:33:18+00:00","updated_at":"2026-11-05T06:33:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T06:33:18Z","model":"claude-haiku-5-5","output":{"fix":"- Dokan (WordPress plugin): update to `5.3.3` or later.","reach":"internet","title":"Dokan WooCommerce marketplace plugin lets strangers read and edit order notes","impact":"medium","summary":"The Dokan WordPress plugin before 5.3.3 does not check authorization when it serves a single order and its order notes. An unauthenticated attacker can read customer and order details and add or delete order notes for some orders.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","dokan","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Customer data readable and order notes altered by unauthenticated visitors","analyst_note":"Confirm the affected version range and whether the advisory names specific endpoints or a CVSS score; the NVD entry alone gives no severity.","how_to_check":"- Check the installed Dokan version in the WordPress admin plugin list or in the plugin's main file header, looking for a version below `5.3.3`.\n- Confirm the Dokan plugin is active on the WooCommerce store.","plain_action":"","needs_analyst":true,"not_affected_if":["version-5.3.3-or-later"],"who_is_affected":"Sites running the Dokan multivendor marketplace plugin on WooCommerce before version 5.3.3 are exposed. The flaw is in order and order-note endpoints, so any store with the plugin active and a vulnerable version is in scope, while stores on 5.3.3 or later are not. The sources do not say which configurations beyond that are required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4235,"output_tokens":591,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107773':14A,17A '-2026':13A,16A '5.3.3':30B,74C 'add':55B,100C 'ai':65C 'allow':89C 'attack':47B,91C 'author':34B,79C 'check':33B 'correct':77C 'custom':50B,94C 'cve':12A,15A 'delet':57B,102C 'detail':53B 'dokan':1A,18B,26B,64C 'edit':9A 'host':22B 'inform':97C 'let':5A 'marketplac':3A,69C 'multivendor':68C 'note':11A,44B,59B,88C,104C 'order':10A,40B,43B,52B,58B,62B,84C,87C,96C,103C,109C 'packag':19B 'plugin':4A,28B,72C 'power':66C 'read':7A,49B,93C 'self':21B 'self-host':20B 'serv':37B,81C 'singl':39B,83C 'solut':70C 'stranger':6A 'subset':107C 'unauthent':46B,90C 'verifi':78C 'woocommerc':2A,23B,67C 'wordpress':24B,27B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Dokan multivendor marketplace plugin on WooCommerce before version 5.3.3 are exposed. The flaw is in order and order-note endpoints, so any store with the plugin active and a vulnerable version is in scope, while stores on 5.3.3 or later are not. The sources do not say which configurations beyond that are required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dokan","high","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107773","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107773","severity":null,"published_at":"2026-11-05T06:17:06+00:00","modified_at":"2026-11-05T06:17:06+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","fetched_at":"2026-11-05T06:31:51+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}