The Dokan WooCommerce Multivendor Marketplace plugin suffers from an Insecure Direct Object Reference vulnerability (CWE-639) in all versions up to and including 5.0.3. Several AJAX handlers (change_order_status, add_order_note, delete_order_note, add_shipping_tracking_info, grant_access_to_download, revoke_access_to_download) lack proper ownership checks on the order ID parameter, which is user-controlled. Authenticated attackers with vendor-level access can exploit this to modify orders they do not own, including changing order statuses, adding or deleting notes (including those triggering customer notifications), injecting fake shipping tracking data, and altering downloadable product permissions. The nonce mechanism intended to protect these actions is ineffective because valid nonces are generated per vendor order pages and can be harvested and replayed against other orders. Source code analysis confirms the vulnerability is present and unpatched through version 5.0.1. No official patch or remediation guidance is currently available.

Authenticated users with vendor-level permissions can bypass authorization controls to manipulate orders they do not own. This includes changing order statuses, adding or deleting order notes (potentially triggering misleading customer notifications), injecting false shipping tracking information, and altering download permissions for products. The vulnerability does not affect confidentiality or availability but impacts integrity and trustworthiness of order data and communications within the marketplace.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict vendor-level user permissions where possible and monitor for suspicious order modifications. Since nonce validation does not prevent exploitation, relying on it alone is insufficient. Vendors should follow updates from dokaninc for patches addressing this authorization bypass.