---
id: "CVE-2026-89280"
kind: "vulnerability"
aliases: ["CVE-2026-89280"]
title: "Dokan WooCommerce marketplace plugin lets vendors reset customer passwords"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dokan", "multivendor-marketplace", "package", "woocommerce", "wordpress"]
not_affected_if: ["dokan-not-installed", "vendor-registration-disabled"]
published_at: "2026-10-16T04:18:41+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:41:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89280", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Dokan WooCommerce marketplace plugin lets vendors reset customer passwords

Dokan, a WordPress multivendor marketplace plugin, fails to validate a user-controlled key in its 'password' parameter through version 5.2.1. An authenticated vendor can change the WordPress password of any customer who has ordered from them and then log in as that customer.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dokan version in the WordPress admin plugin list or with `wp plugin get dokan-lite --field=version` (or the `dokan` package name for the Pro build)
- Check whether the 'I am a vendor' self-registration option is enabled under Dokan settings

## Fix

- Update Dokan to a version later than `5.2.1` (the sources do not name the patched version)

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89280

## From the sources

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to change the WordPress account password of any customer who has placed at least one order with the attacking vendor, enabling login as that customer and resulting in a limited account takeover. Vendor-level access, required to exploit this vulnerability, can be self-registered through the public 'I am a vendor' registration flow when that option is enabled on the site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_