The Dokan Pro plugin for WordPress contains a critical privilege escalation flaw that could allow an attacker to gain unauthorized administrative control over the site.

This vulnerability involves an insecure REST API endpoint, update_capabilities, which fails to properly validate user permissions. An attacker can exploit this to escalate their current user privileges, potentially gaining full administrative access to the WordPress installation.

With a CVSS score of 8.8, this vulnerability poses a severe risk to the entire web application. Privilege escalation allows an attacker to bypass standard security controls, leading to total site compromise, data exfiltration, or the injection of malicious code, which could result in significant reputational damage and loss of customer trust.

Immediate Action: Update the Dokan Pro plugin to the latest version immediately to patch the vulnerable REST endpoint.

Proactive Monitoring: Monitor WordPress user role changes and administrative login activity for any unexpected modifications to user capabilities.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests targeting the update_capabilities REST endpoint until the plugin can be updated.

Public Exploit Available: false

Privilege escalation vulnerabilities in plugins are frequently targeted by automated botnets. It is critical to patch the Dokan Pro plugin immediately. Organizations should also perform a security audit of current administrative users to ensure no unauthorized accounts were created during the period the site remained vulnerable.