CVE-2026-16574 is an authorization bypass vulnerability classified under CWE-639 in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin. Versions prior to 5.0.11 do not properly verify ownership of downloadable products when processing download permission requests through an order REST endpoint. As a result, an authenticated vendor can manipulate the system to allow their customers to download paid files from other vendors without payment or authorization.

The vulnerability allows an authenticated vendor to grant unauthorized free access to paid downloadable products owned by other vendors. This can lead to revenue loss for affected vendors and undermines the integrity of the marketplace's access controls. There is no indication of remote unauthenticated exploitation or broader system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 5.0.11, upgrading to version 5.0.11 or later is likely recommended once confirmed by the vendor. Until an official fix is available, restrict vendor permissions or monitor vendor activity closely to mitigate unauthorized download sharing.