CVE-2026-8761 is a missing authorization vulnerability (CWE-862) in the Dokan plugin for WordPress, specifically in the CustomersController REST controller. The plugin re-registers WooCommerce's customer CRUD routes under the /dokan/v1/customers/ namespace but replaces the native manage_woocommerce capability check with a vendor-only check that only inspects the requesting user's role. It fails to validate the permissions of the target user being accessed or modified. This flaw allows authenticated attackers with Vendor or Seller roles to perform GET, PUT, and DELETE requests on any WordPress user account, including administrators. By setting the password parameter on an administrator account, an attacker can take full control of the site.

An attacker with authenticated Vendor/Seller-level access can escalate privileges to administrator level by modifying administrator user accounts, including resetting passwords. This leads to full site compromise, affecting confidentiality, integrity, and availability of the WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Vendor/Seller role access carefully and monitor for suspicious API activity targeting /wp-json/dokan/v1/customers/.