Critically, the implementation fails to perform an authorization check on the target user object, instead performing a flawed check on the requesting user's role. Consequently, any user with 'Vendor' or 'Seller' capabilities can interact with the API to read, update, or delete any arbitrary user within the WordPress database. An attacker can specifically target an administrator's record and modify the password parameter, resulting in a complete site takeover. This vulnerability poses an extreme risk for multi-vendor WordPress environments utilizing the Dokan plugin.

Impact

Successful exploitation results in full administrative control over the affected WordPress installation. Given the prevalence of Dokan in e-commerce deployments, this vulnerability facilitates unauthorized access to sensitive customer data, order history, and platform settings. If exploited, an attacker can modify administrative account credentials, inject malicious code, or exfiltrate databases associated with the site.

Recommendation

• Immediately update the Dokan plugin to a version patched against CVE-2026-8761.
• Audit WordPress user logs for unexpected modifications to administrative accounts.
• Monitor REST API traffic for unauthorized PUT or DELETE requests targeting the /wp-json/dokan/v1/customers/ endpoint.
• Restrict access to administrative dashboard functions and API endpoints to trusted IP ranges where feasible.