CVE-2026-107775 · Package
NO FIX YET · SEE WHAT TO DO
The Dokan WordPress plugin before 5.3.3 does not check that an administrator may manage each selected user before enabling their seller status. On WordPress Multisite, a subsite Administrator can therefore turn selling on for users outside their own site, including network-level users they cannot otherwise manage.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Dokan marketplace plugin before 5.3.3 on WordPress Multisite are exposed, because the flaw lets a subsite Administrator change seller status for users outside their site. Single-site WordPress installs with only one administrator scope are not affected by the cross-site part of the issue. unknown for whether other configurations are affected.
Not affected if dokan-5.3.3-or-later, single-site-wordpress
Who cares dokan, multisite, woocommerce, wordpress
wp plugin get dokan-lite (or wp plugin get dokan) on the server.5.3.3 or later.The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.