Vulnerability · Published Nov 5, 2026 · Assigned by WPScan
CVE-2026-107773Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint
Unrated
In plain English
A security flaw in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS )–Not rated
Exploit odds (30 days)0.1%top 96.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution | 0 – before 5.3.3 |
References
- https://wpscan.com/vulnerability/7ef1f47f-60d2-41f0-afca-584752503fae/ exploit, vdb-entry, technical-description