---
id: "CVE-2026-107775"
kind: "vulnerability"
aliases: ["CVE-2026-107775"]
title: "Dokan WooCommerce marketplace plugin lets subsite admins enable sellers network-wide"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dokan", "multisite", "package", "woocommerce", "wordpress"]
not_affected_if: ["dokan-5.3.3-or-later", "single-site-wordpress"]
published_at: "2026-11-05T06:17:07+00:00"
first_seen_at: "2026-11-05T06:31:51+00:00"
updated_at: "2026-11-05T06:33:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107775", "first_seen_at": "2026-11-05T06:31:51+00:00"}]
exploit_sources: []
---

# Dokan WooCommerce marketplace plugin lets subsite admins enable sellers network-wide

The Dokan WordPress plugin before 5.3.3 does not check that an administrator may manage each selected user before enabling their seller status. On WordPress Multisite, a subsite Administrator can therefore turn selling on for users outside their own site, including network-level users they cannot otherwise manage.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dokan version in the WordPress plugins screen or with `wp plugin get dokan-lite` (or `wp plugin get dokan`) on the server.
- Confirm whether the site runs WordPress Multisite.

## Fix

- Dokan (WordPress plugin): move to `5.3.3` or later.

## Timeline

- 2026-11-05T06:31:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107775

## From the sources

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_