CVE-2026-107776 · Package
NO FIX YET · SEE WHAT TO DO
Before version 5.3.3, the Dokan WordPress marketplace plugin does not match the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected at checkout. When a discount coupon is applied, a vendor can clear their outstanding commission debt while paying less than they owe.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Dokan WordPress marketplace plugin before 5.3.3 that use reverse withdrawals for vendor commission debt and allow discount coupons at checkout. The flaw is a ledger reconciliation issue, so the risk is financial rather than remote code execution; a marketplace operator that does not use reverse withdrawals can skip it.
Not affected if dokan-5.3.3-or-later, no-coupons, no-reverse-withdrawals
Who cares dokan, marketplace, woocommerce, wordpress
wp plugin get dokan-lite --field=version if WP-CLI is available.5.3.3 or later.The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.