Vendor
An improper authorization flaw in the Dokan plugin for WordPress allows authenticated attackers with vendor-level access to escalate privileges to administrator via manipulation of the REST API.