CVE-2026-89280: CWE-639 Authorization Bypass Through User-Controlled Key in dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy

CVE-2026-89280 is an authorization bypass vulnerability (CWE-639) in the Dokan WooCommerce Multivendor Marketplace plugin for WordPress. The vulnerability arises from missing validation on a user-controlled 'password' parameter, allowing authenticated attackers with custom-level vendor access or above to change the WordPress passwords of customers who have ordered from them. This leads to limited account takeover capabilities. The vulnerability affects all versions up to and including 5.2.1. Exploitation requires vendor-level access, which can be self-registered if the site enables the public 'I am a vendor' registration option.

An attacker with custom-level vendor access or higher can change the WordPress account password of any customer who has placed at least one order with that vendor, enabling login as that customer. This results in a limited account takeover, potentially allowing the attacker to perform actions on behalf of the customer within WordPress. The vulnerability does not impact confidentiality but impacts integrity due to unauthorized password changes. There is no indication of availability impact.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the public 'I am a vendor' registration flow if not needed to reduce risk. Restrict vendor registration and monitor for suspicious vendor accounts. Apply principle of least privilege to vendor roles. Follow vendor advisories for updates and patches.