CVE-2026-3504 is a sensitive information exposure vulnerability (CWE-200) in the Dokan WooCommerce Multivendor Marketplace Solution plugin for WordPress. The vulnerability exists in all versions up to and including 4.3.1. The issue arises because the 'prepare_reviews_for_response' method includes sensitive reviewer details such as email addresses, usernames, and user IDs in the API response from the '/dokan/v1/stores/{id}/reviews' REST endpoint. This endpoint is accessible without authentication, allowing any unauthenticated attacker to retrieve this data if the Pro version is installed and store reviews are enabled. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality.

The vulnerability allows unauthorized disclosure of sensitive customer information including email addresses, usernames, and user IDs of reviewers on vendor stores. This exposure could facilitate privacy breaches and potentially enable targeted phishing or social engineering attacks. There is no impact on data integrity or system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling store reviews or restricting access to the '/dokan/v1/stores/{id}/reviews' REST API endpoint to authenticated users only. Monitor vendor communications for updates and apply patches promptly once released.