The Dokan Pro WordPress plugin is vulnerable to improper privilege management (CWE-269) in all versions up to 5.0.4. The vulnerability arises because the update_capabilities REST handler accepts arbitrary capability strings from the request body and passes them directly to WP_User::add_cap() without allowlist validation. The only check performed is that the caller has the dokandar capability. This flaw allows authenticated attackers with Vendor-level access or higher, on sites with the Vendor Staff module enabled, to escalate privileges by granting themselves or others administrator capabilities, resulting in complete site compromise.

Successful exploitation allows authenticated users with Vendor-level access or above to escalate privileges by assigning arbitrary WordPress capabilities, including administrator rights, to vendor_staff accounts. This leads to full site takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the update_capabilities REST endpoint and disable the Vendor Staff module if not required. Monitor for updates from wedevs and apply official patches promptly once released.