CVE-2026-16565 is an authorization bypass vulnerability (CWE-639) in the Dokan WordPress plugin for WooCommerce multivendor marketplaces. The plugin versions prior to 5.0.9 do not verify product ownership on product-attribute REST API write endpoints, enabling authenticated vendor users to alter product attributes and default attributes of products they do not own. This flaw arises from insufficient authorization checks on user-controlled keys in the API requests.

An attacker with a Dokan vendor account can modify attributes of other vendors' products, potentially affecting product data integrity and marketplace trust. This could lead to unauthorized changes in product listings, misleading customers or disrupting vendor operations. There is no indication of remote code execution or data disclosure beyond attribute modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Users should monitor for vendor updates addressing this authorization bypass vulnerability and apply patches promptly once available. Until then, consider restricting vendor permissions or limiting access to the REST API endpoints if feasible.