CVE-2026-16576: CWE-284 Improper Access Control in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

CVE-2026-16576 describes an improper access control vulnerability (CWE-284) in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin prior to version 5.0.14. The plugin's admin REST API routes fail to correctly verify user permissions, relying solely on WooCommerce management capabilities rather than the intended Dokan installation capability. This misconfiguration enables users with elevated but limited roles, such as Shop Managers, to install and activate arbitrary versions of the Dokan plugin from WordPress.org, potentially leading to full compromise of the plugin's functionality and associated data.

Successful exploitation allows users with Shop Manager privileges to escalate their capabilities by installing and activating arbitrary versions of the Dokan plugin. This can lead to full compromise of the plugin environment, including unauthorized code execution, data manipulation, and disruption of marketplace operations. The CVSS v3.1 score of 7.2 reflects high impact on confidentiality, integrity, and availability.

A fix is available in Dokan version 5.0.14 and later. Users should upgrade to version 5.0.14 or newer to ensure proper capability checks are enforced on admin REST API routes. Until upgraded, restrict Shop Manager role permissions to prevent exploitation. Patch status is confirmed by the version boundary in the vulnerability description.