{"id":"CVE-2026-107774","kind":"vulnerability","aliases":["CVE-2026-107774"],"related":[],"title":"Dokan WordPress plugin: contact form lets attackers spoof site email","description":"The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.","summary":"The Dokan WooCommerce marketplace plugin before 5.3.3 places the contact form submitter's address in the From header instead of a site-owned sender. An unauthenticated attacker can make the site send email to its vendors that appears to come from an address on the site's own domain, such as its administrator.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dokan","package","self-hosted","woocommerce","wordpress"],"not_affected_if":["contact-form-unused","plugin-not-installed","plugin-version-5.3.3-or-later"],"how_to_check":"- Check the installed Dokan plugin version in the WordPress admin plugins list or in the plugin's main file header.\n- Confirm whether the store uses the contact form that relays messages to vendors.","fix":"- Dokan WordPress plugin: move to `5.3.3` or later","status":"open","published_at":"2026-11-05T06:17:07+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","triaged_at":"2026-11-05T06:33:17+00:00","updated_at":"2026-11-05T06:33:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T06:33:17Z","model":"claude-haiku-5-5","output":{"fix":"- Dokan WordPress plugin: move to `5.3.3` or later","reach":"internet","title":"Dokan WordPress plugin: contact form lets attackers spoof site email","impact":"low","summary":"The Dokan WooCommerce marketplace plugin before 5.3.3 places the contact form submitter's address in the From header instead of a site-owned sender. An unauthenticated attacker can make the site send email to its vendors that appears to come from an address on the site's own domain, such as its administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","dokan","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attackers send spoofed email to vendors from the site's own domain","analyst_note":"","how_to_check":"- Check the installed Dokan plugin version in the WordPress admin plugins list or in the plugin's main file header.\n- Confirm whether the store uses the contact form that relays messages to vendors.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-version-5.3.3-or-later","contact-form-unused"],"who_is_affected":"Stores running the Dokan WordPress plugin before 5.3.3 that use its contact form to email vendors are exposed. The flaw is reachable without an account, so any site with the plugin and the form enabled should be treated as exposed until updated. Sites not running Dokan can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4303,"output_tokens":555,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107774':13A,16A '-2026':12A,15A '5.3.3':30B,89C 'address':37B,67B,99C,113C,144C 'administr':77B,154C 'ai':80C 'align':155C 'allow':127C 'appear':62B 'attack':7A,51B,129C 'come':64B 'contact':4A,33B,104C 'cve':11A,14A 'direct':114C 'dokan':1A,17B,25B,79C 'domain':73B,150C,158C 'email':10A,57B,134C 'form':5A,34B,105C 'header':41B,120C 'host':21B 'instead':42B,106C 'let':6A 'make':53B,131C 'marketplac':27B,84C 'messag':117C 'multivendor':83C 'own':47B,97C 'packag':18B 'place':31B,107C 'plugin':3A,28B,87C 'power':81C 'rather':121C 'relay':101C 'repli':125C 'reply-to':124C 'self':20B 'self-host':19B 'send':56B 'sender':48B,98C,140C 'site':9A,46B,55B,70B,96C,133C,147C 'site-own':45B,95C 'solut':85C 'spf/dkim':161C 'spoof':8A,141C 'store':103C 'submitt':35B,110C 'suppli':112C 'trust':94C 'unauthent':50B,109C,128C 'use':92C 'vendor':60B,137C 'woocommerc':22B,26B,82C 'wordpress':2A,23B,86C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Dokan WordPress plugin before 5.3.3 that use its contact form to email vendors are exposed. The flaw is reachable without an account, so any site with the plugin and the form enabled should be treated as exposed until updated. Sites not running Dokan can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dokan","medium","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107774","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107774","severity":null,"published_at":"2026-11-05T06:17:07+00:00","modified_at":"2026-11-05T06:17:07+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","fetched_at":"2026-11-05T06:31:51+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}