CVE-2026-8761: Privilege Escalation in Dokan WordPress Plugin

The Dokan plugin for WordPress (versions 5.0.1 and earlier) is vulnerable to a severe privilege escalation vulnerability tracked as CVE-2026-8761. The issue originates in the CustomersController REST controller located at includes/REST/CustomersController.php. The plugin registers custom REST routes under the /dokan/v1/customers/ namespace by re-implementing WooCommerce customer CRUD functionality.

Critically, the implementation fails to perform an authorization check on the target user object, instead performing a flawed check on the requesting user's role. Consequently, any user with 'Vendor' or 'Seller' capabilities can interact with the API to read, update, or delete any arbitrary user within the WordPress database. An attacker can specifically target an administrator's record and modify the password parameter, resulting in a complete site takeover. This vulnerability poses an extreme risk for multi-vendor WordPress environments utilizing the Dokan plugin.

Impact

Successful exploitation results in full administrative control over the affected WordPress installation. Given the prevalence of Dokan in e-commerce deployments, this vulnerability facilitates unauthorized access to sensitive customer data, order history, and platform settings. If exploited, an attacker can modify administrative account credentials, inject malicious code, or exfiltrate databases associated with the site.

Recommendation

• Immediately update the Dokan plugin to a version patched against CVE-2026-8761.
• Audit WordPress user logs for unexpected modifications to administrative accounts.
• Monitor REST API traffic for unauthorized PUT or DELETE requests targeting the /wp-json/dokan/v1/customers/ endpoint.
• Restrict access to administrative dashboard functions and API endpoints to trusted IP ranges where feasible.