{"id":"CVE-2026-89280","kind":"vulnerability","aliases":["CVE-2026-89280"],"related":[],"title":"Dokan WooCommerce marketplace plugin lets vendors reset customer passwords","description":"The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to change the WordPress account password of any customer who has placed at least one order with the attacking vendor, enabling login as that customer and resulting in a limited account takeover. Vendor-level access, required to exploit this vulnerability, can be self-registered through the public 'I am a vendor' registration flow when that option is enabled on the site.","summary":"Dokan, a WordPress multivendor marketplace plugin, fails to validate a user-controlled key in its 'password' parameter through version 5.2.1. An authenticated vendor can change the WordPress password of any customer who has ordered from them and then log in as that customer.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dokan","multivendor-marketplace","package","woocommerce","wordpress"],"not_affected_if":["dokan-not-installed","vendor-registration-disabled"],"how_to_check":"- Check the installed Dokan version in the WordPress admin plugin list or with `wp plugin get dokan-lite --field=version` (or the `dokan` package name for the Pro build)\n- Check whether the 'I am a vendor' self-registration option is enabled under Dokan settings","fix":"- Update Dokan to a version later than `5.2.1` (the sources do not name the patched version)","status":"open","published_at":"2026-10-16T04:18:41+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:41:22+00:00","updated_at":"2026-10-25T04:41:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:41:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update Dokan to a version later than `5.2.1` (the sources do not name the patched version)","reach":"internet","title":"Dokan WooCommerce marketplace plugin lets vendors reset customer passwords","impact":"medium","summary":"Dokan, a WordPress multivendor marketplace plugin, fails to validate a user-controlled key in its 'password' parameter through version 5.2.1. An authenticated vendor can change the WordPress password of any customer who has ordered from them and then log in as that customer.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","dokan","multivendor-marketplace"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over customer accounts by resetting their passwords","analyst_note":"Find the patched Dokan version and confirm whether the 'I am a vendor' registration option is on by default, using the NVD entry and the vendor changelog.","how_to_check":"- Check the installed Dokan version in the WordPress admin plugin list or with `wp plugin get dokan-lite --field=version` (or the `dokan` package name for the Pro build)\n- Check whether the 'I am a vendor' self-registration option is enabled under Dokan settings","needs_analyst":true,"not_affected_if":["dokan-not-installed","vendor-registration-disabled"],"who_is_affected":"Sites running Dokan 5.2.1 or earlier with a marketplace where customers place orders with vendors. The risk is higher when the 'I am a vendor' self-registration option is enabled, because anyone can create the vendor account needed to exploit it. Stores without Dokan, or with vendor registration closed and no untrusted vendor accounts, have less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000665,"input_tokens":3480,"output_tokens":634,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-89280':12A,15A '5.2.1':43B,98C 'access':123C,161C 'account':130C,156C 'ai':69C 'amazon':78C 'attack':118C,144C 'authent':45B,117C 'build':75C 'chang':48B,127C 'control':35B,110C 'custom':8A,54B,66B,121C,134C,150C 'custom-level':120C 'cve':10A,13A 'direct':88C 'dokan':1A,16B,23B,68C 'due':103C 'ebay':79C 'enabl':146C,185C 'etsi':80C 'exploit':164C 'fail':29B 'flow':180C 'includ':97C 'insecur':87C 'key':36B,111C 'least':139C 'let':5A 'level':122C,160C 'limit':155C 'log':62B 'login':147C 'make':113C 'marketplac':3A,19B,27B,73C 'miss':105C 'multivendor':18B,26B,72C 'multivendor-marketplac':17B 'object':89C 'one':140C 'option':183C 'order':57B,141C 'packag':20B 'paramet':40B,102C 'password':9A,39B,51B,101C,131C 'place':137C 'plugin':4A,28B,81C 'possibl':115C 'power':70C 'public':174C 'refer':90C 'regist':171C 'registr':179C 'requir':162C 'reset':7A 'result':152C 'self':170C 'self-regist':169C 'site':188C 'solut':74C 'takeov':157C 'user':34B,109C 'user-control':33B 'valid':31B,106C 'vendor':6A,46B,145C,159C,178C 'vendor-level':158C 'version':42B,93C 'via':99C 'vulner':85C,166C 'woocommerc':2A,21B,71C 'wordpress':22B,25B,50B,83C,129C","nicknames":[],"mitigations":[],"who_affected":"Sites running Dokan 5.2.1 or earlier with a marketplace where customers place orders with vendors. The risk is higher when the 'I am a vendor' self-registration option is enabled, because anyone can create the vendor account needed to exploit it. Stores without Dokan, or with vendor registration closed and no untrusted vendor accounts, have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T04:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89280","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89280","severity":null,"published_at":"2026-10-16T04:18:41+00:00","modified_at":"2026-10-16T15:17:33+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}