Threats tagged 'ghsa-jg3r-6p98-c2mp'

A vulnerability in the Dokan WordPress plugin versions prior to 5.3.3 allows vendors to manipulate their reverse-withdrawal ledger. Specifically, the plugin does not properly reconcile the amount credited to a vendor's ledger against the actual amount collected when a discount coupon is applied at checkout. This flaw enables a vendor to clear their outstanding commission debt while paying less than the owed balance.