CVE-2026-12224 is a privilege escalation vulnerability in the Dokan Pro WordPress plugin affecting all versions up to and including 5.0.4. The issue stems from the update_capabilities REST handler accepting arbitrary capability strings from the request body and passing them directly to WP_User::add_cap() without an allowlist validation. The handler only verifies that the caller has the dokandar capability, which is held by authenticated users with Vendor-level access or above on sites with the Vendor Staff module enabled. This flaw enables such users to escalate privileges by granting themselves or others administrator capabilities, resulting in potential full site takeover.

An authenticated attacker with Vendor-level access or higher can exploit this vulnerability to grant arbitrary WordPress capabilities, including administrator privileges, to any vendor_staff account. This leads to a complete compromise of the affected WordPress site, including confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Vendor Staff module and limit Vendor-level user privileges. Monitor for updates from wedevs regarding patches or official mitigations.