The Dokan WordPress plugin versions prior to 5.0.14 do not properly restrict access to a REST endpoint that returns commission configuration details for vendors. Because the endpoint is accessible without authentication, any unauthenticated user can retrieve sensitive commission information, including commission types and rates when category-based commissions are configured. This constitutes an information disclosure vulnerability (CWE-200). No CVSS score or exploit in the wild is currently reported, and no official remediation or patch information is provided in the available data.

The vulnerability allows unauthenticated attackers to disclose sensitive business information related to vendor commission structures. This could potentially aid in competitive intelligence gathering or other unauthorized business insights. There is no indication of direct compromise of user data or system integrity from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected REST endpoint by implementing authentication or access controls at the web server or application level to prevent unauthenticated access to commission configuration data.