---
id: "CVE-2026-107774"
kind: "vulnerability"
aliases: ["CVE-2026-107774"]
title: "Dokan WordPress plugin: contact form lets attackers spoof site email"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dokan", "package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["contact-form-unused", "plugin-not-installed", "plugin-version-5.3.3-or-later"]
published_at: "2026-11-05T06:17:07+00:00"
first_seen_at: "2026-11-05T06:31:51+00:00"
updated_at: "2026-11-05T06:33:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107774", "first_seen_at": "2026-11-05T06:31:51+00:00"}]
exploit_sources: []
---

# Dokan WordPress plugin: contact form lets attackers spoof site email

The Dokan WooCommerce marketplace plugin before 5.3.3 places the contact form submitter's address in the From header instead of a site-owned sender. An unauthenticated attacker can make the site send email to its vendors that appears to come from an address on the site's own domain, such as its administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dokan plugin version in the WordPress admin plugins list or in the plugin's main file header.
- Confirm whether the store uses the contact form that relays messages to vendors.

## Fix

- Dokan WordPress plugin: move to `5.3.3` or later

## Timeline

- 2026-11-05T06:31:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107774

## From the sources

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_