CVE-2025-12809 is a missing authorization vulnerability (CWE-862) in the Dokan Pro plugin for WordPress. The vulnerability arises because the /dokan/v1/wholesale/register REST API endpoint does not perform capability checks, allowing unauthenticated attackers to enumerate users by providing user IDs. This leads to unauthorized disclosure of user information including email addresses, usernames, display names, user roles, and registration dates. The issue affects all versions up to and including 4.1.3. The CVSS 3.1 base score is 5.3 (medium severity) with an attack vector of network, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

The vulnerability allows unauthenticated attackers to retrieve sensitive user information such as email addresses and user metadata from affected Dokan Pro installations. This unauthorized data disclosure could facilitate further targeted attacks or phishing campaigns. There is no indication of impact on data integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected REST API endpoint via web application firewall rules or other access controls to prevent unauthenticated access. Monitor vendor communications for updates and apply patches promptly once available.