CVE-2026-16564 is an authorization bypass vulnerability (CWE-639) in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.0.9. The flaw exists because the plugin does not verify order ownership on a REST API endpoint responsible for bulk order-status changes. As a result, authenticated users with a Dokan vendor account can modify the status of any WooCommerce order on the marketplace, including those belonging to other vendors and customers, potentially impacting order integrity.

The vulnerability allows a vendor-level user to alter the status of orders they do not own, which could lead to unauthorized changes in order processing and fulfillment. This may disrupt marketplace operations and cause confusion or financial discrepancies among vendors and customers. There is no indication of confidentiality or availability impact, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict vendor account privileges where possible and monitor for unusual order status changes. Avoid granting unnecessary permissions to vendor accounts.