CVE-2026-107694: CWE-200 Information Exposure in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
Description
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.
CVSS v3.1
Score 2.7low
Affected software
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-107694 describes an information exposure vulnerability (CWE-200) in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.2.0. The flaw arises from insufficient verification of vendor identity when commission calculation data is requested. As a result, a vendor can retrieve commission rates and fixed fees set by the marketplace administrator for other vendors, which should be confidential.
Potential Impact
The vulnerability allows unauthorized vendors to disclose sensitive financial configuration details of other vendors, specifically commission rates and fixed fees set by the marketplace administrator. This exposure could lead to competitive disadvantages or privacy concerns but does not indicate direct compromise of system integrity or availability.
Mitigation Recommendations
Upgrade the Dokan plugin to version 5.2.0 or later, where this vulnerability is fixed. Since the affected versions are prior to 5.2.0, applying the official update will resolve the issue. No other mitigation guidance is provided or necessary.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-08T16:17:15.706Z
- State
- PUBLISHED
Threat ID: 6acb2ddf2cdf04f656b78cea
Added to database: 10/11/2026, 06:34:07 UTC
Last enriched: 10/11/2026, 07:18:25 UTC
Last updated: 10/11/2026, 21:33:43 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.