The Dokan plugin re-registers WooCommerce's customer CRUD routes under the /dokan/v1/customers/ namespace but replaces the native manage_woocommerce capability check with a vendor-only check that validates only the requesting user's role, not the target user's permissions. This missing authorization check in includes/REST/CustomersController.php enables privilege escalation for authenticated Vendor/Seller-level users, allowing them to perform GET, PUT, and DELETE operations on any WordPress user, including administrators. Setting the password parameter on an administrator's user record can result in complete site compromise.

An authenticated attacker with Vendor/Seller-level access can escalate privileges to administrator level by modifying administrator accounts, including changing passwords. This leads to full site takeover, compromising confidentiality, integrity, and availability of the WordPress site and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Vendor/Seller-level user permissions and monitor for suspicious activity related to the /wp-json/dokan/v1/customers/ REST endpoints.