CVE-2026-16576 describes an improper access control vulnerability (CWE-284) in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.0.14. The plugin fails to verify the correct user capability on some admin REST API routes, relying solely on WooCommerce management permissions rather than the plugin-specific installation capability. This flaw permits users with Shop Manager privileges to install and activate arbitrary versions of the Dokan plugin from WordPress.org, potentially escalating their privileges within the WordPress environment.

Users with Shop Manager roles can exploit this vulnerability to install and activate arbitrary versions of the Dokan plugin, which could lead to unauthorized plugin installations and potential privilege escalation within the WordPress site. This undermines the intended access control restrictions and may allow unauthorized administrative actions.

No official patch or remediation guidance is currently available. Users should upgrade to version 5.0.14 or later once it is released, as the vulnerability affects versions before 5.0.14. Until a fix is available, restrict Shop Manager capabilities to trusted users only and monitor plugin installations closely. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.