{"id":"CVE-2026-107775","kind":"vulnerability","aliases":["CVE-2026-107775"],"related":[],"title":"Dokan WooCommerce marketplace plugin lets subsite admins enable sellers network-wide","description":"The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.","summary":"The Dokan WordPress plugin before 5.3.3 does not check that an administrator may manage each selected user before enabling their seller status. On WordPress Multisite, a subsite Administrator can therefore turn selling on for users outside their own site, including network-level users they cannot otherwise manage.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dokan","multisite","package","woocommerce","wordpress"],"not_affected_if":["dokan-5.3.3-or-later","single-site-wordpress"],"how_to_check":"- Check the installed Dokan version in the WordPress plugins screen or with `wp plugin get dokan-lite` (or `wp plugin get dokan`) on the server.\n- Confirm whether the site runs WordPress Multisite.","fix":"- Dokan (WordPress plugin): move to `5.3.3` or later.","status":"open","published_at":"2026-11-05T06:17:07+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","triaged_at":"2026-11-05T06:33:16+00:00","updated_at":"2026-11-05T06:33:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:16Z","model":"claude-haiku-5-5","output":{"fix":"- Dokan (WordPress plugin): move to `5.3.3` or later.","reach":"network","title":"Dokan WooCommerce marketplace plugin lets subsite admins enable sellers network-wide","impact":"low","summary":"The Dokan WordPress plugin before 5.3.3 does not check that an administrator may manage each selected user before enabling their seller status. On WordPress Multisite, a subsite Administrator can therefore turn selling on for users outside their own site, including network-level users they cannot otherwise manage.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","dokan","multisite"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Subsite administrator enables selling for users they cannot manage","analyst_note":"","how_to_check":"- Check the installed Dokan version in the WordPress plugins screen or with `wp plugin get dokan-lite` (or `wp plugin get dokan`) on the server.\n- Confirm whether the site runs WordPress Multisite.","plain_action":"","needs_analyst":false,"not_affected_if":["single-site-wordpress","dokan-5.3.3-or-later"],"who_is_affected":"Sites running the Dokan marketplace plugin before 5.3.3 on WordPress Multisite are exposed, because the flaw lets a subsite Administrator change seller status for users outside their site. Single-site WordPress installs with only one administrator scope are not affected by the cross-site part of the issue. unknown for whether other configurations are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4262,"output_tokens":584,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107775':15A,18A '-2026':14A,17A '5.3.3':29B,83C 'act':89C 'admin':7A 'administr':35B,51B,90C,109C 'ai':74C 'allow':106C 'author':92C 'cannot':69B,128C 'check':32B 'cve':13A,16A 'dokan':1A,19B,25B,73C 'enabl':8A,42B,99C,114C 'includ':63B,122C 'let':5A 'level':66B,125C 'manag':37B,71B,94C,130C 'marketplac':3A,78C,103C 'may':36B 'multisit':20B,48B,112C 'multivendor':77C 'network':11A,65B,124C 'network-level':64B,123C 'network-wid':10A 'otherwis':70B,129C 'outsid':59B,118C 'packag':21B 'plugin':4A,27B,81C 'power':75C 'select':39B,96C 'sell':55B,115C 'seller':9A,44B,104C 'site':62B,121C 'solut':79C 'status':45B,105C 'subsit':6A,50B,108C 'therefor':53B 'turn':54B 'user':40B,58B,67B,97C,101C,117C,126C 'verifi':86C 'wide':12A 'woocommerc':2A,22B,76C 'wordpress':23B,26B,47B,80C,111C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Dokan marketplace plugin before 5.3.3 on WordPress Multisite are exposed, because the flaw lets a subsite Administrator change seller status for users outside their site. Single-site WordPress installs with only one administrator scope are not affected by the cross-site part of the issue. unknown for whether other configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dokan","medium","multisite","package","woocommerce","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107775","severity":null,"published_at":"2026-11-05T06:17:07+00:00","modified_at":"2026-11-05T06:17:07+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","fetched_at":"2026-11-05T06:31:51+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}