An Insecure Direct Object Reference vulnerability in the Dokan plugin for WordPress allows authenticated attackers to manipulate sensitive vendor payment information and potentially facilitate financial theft.

This vulnerability exists in the /wp-json/dokan/v1/settings REST API endpoint due to improper access control. Attackers with customer-level permissions or higher can read or modify sensitive vendor data, including bank account details and PayPal addresses, by exploiting missing validation on a user-controlled key.

The ability for an unauthorized user to modify payment routing information poses a critical threat to the financial integrity of the marketplace. An attacker could redirect vendor payouts to their own accounts, leading to direct financial loss, significant reputational damage, and potential legal liability. With a CVSS score of 8.1, the vulnerability is classified as High severity due to the high impact on data integrity and the relative ease of exploitation for authenticated users.

Immediate Action: Update the Dokan plugin to version 4.2.5 or later, where this access control flaw has been addressed.

Proactive Monitoring: Monitor REST API access logs for unusual patterns or repeated requests to the /wp-json/dokan/v1/settings endpoint, particularly from accounts with standard customer roles.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access attempts to the vulnerable REST API endpoint if immediate patching is not feasible.

Public Exploit Available: Unknown

Given the potential for direct financial theft through payment redirection, organizations utilizing the Dokan plugin must prioritize applying the available security update immediately. Administrators should also audit existing vendor settings to ensure that no unauthorized changes have been made to payment information while the site was running a vulnerable version.