CVE-2026-16574 is an authorization bypass vulnerability (CWE-639) in the Dokan WordPress plugin for WooCommerce multivendor marketplaces. Versions prior to 5.0.11 fail to verify ownership of downloadable products when processing download permission requests through an order REST API endpoint. This allows an authenticated vendor to improperly grant download access to paid files owned by other vendors, potentially leading to unauthorized distribution of paid content.

The vulnerability allows authenticated vendors to grant unauthorized download access to paid downloadable products belonging to other vendors. This could result in revenue loss due to unauthorized free distribution of paid content. The confidentiality and integrity of vendor product access controls are compromised. There is no indication of impact on availability. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict vendor permissions and closely audit download access requests to mitigate unauthorized access risks.