Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:dokan:_ai_powered_woocommerce_multivendor_marketplace_solution:*:*:*:*:*:*:*:*
part: a version: _ai_powered_woocommerce_multivendor_marketplace_solution update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Dokan (34c521da-c093-581f-9868-9e550e1e75e5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-16564 |
vulnerable | 2026-09-16 04:32:56.619455 |
Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk order-status changes, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace, including orders belonging to other vendors and the store's own customers.
Published: 2026-08-03T06:00:14.455Z
Updated: 2026-08-03T17:30:48.721Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16574 |
vulnerable | 2026-09-16 04:32:56.516002 |
Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.
Published: 2026-08-08T06:00:11.760Z
Updated: 2026-08-11T19:36:27.601Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16565 |
vulnerable | 2026-09-16 04:32:56.324745 |
Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor's products on the marketplace.
Published: 2026-08-03T06:00:14.630Z
Updated: 2026-08-03T17:30:41.066Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.