The Dokan WooCommerce Multivendor Marketplace plugin suffers from an improper access control vulnerability (CWE-284) due to missing validation on a user-controlled key in the /wp-json/dokan/v1/settings REST API endpoint. This insecure direct object reference allows authenticated users with at least customer-level permissions to read or modify other vendors' sensitive store settings, including payment information and contact details. The vulnerability can be exploited to redirect payouts to attacker-controlled PayPal accounts, posing a significant financial risk. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with network attack vector and low attack complexity.

An attacker with authenticated access at the customer level or above can access and alter other vendors' sensitive store settings, including payment credentials such as PayPal emails and bank account details. This can lead to unauthorized financial theft by redirecting marketplace payouts to attacker-controlled accounts. The vulnerability compromises confidentiality and integrity of vendor data but does not affect availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user permissions to trusted vendors only and monitor for suspicious changes in vendor payment settings. Avoid granting unnecessary elevated permissions to users. Follow vendor updates closely for an official patch or temporary mitigation.