Vulnerability · Published Nov 5, 2026 · Assigned by WPScan
CVE-2026-107775Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation
Unrated
In plain English
A security flaw in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS )–Not rated
Exploit odds (30 days)0.1%top 97.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution | 0 – before 5.3.3 |
References
- https://wpscan.com/vulnerability/7a1d3c6c-fb78-41cc-85bb-4d86ac1ca3df/ exploit, vdb-entry, technical-description