A critical access control vulnerability in the Dokan WordPress plugin allows authenticated users to achieve unauthorized plugin installation and activation, potentially leading to full site compromise.

This is an improper access control vulnerability (CWE-284) where the plugin improperly validates user capabilities on admin REST API routes. An attacker with existing low-level administrative privileges, such as a Shop Manager, can bypass intended restrictions to perform unauthorized administrative actions.

Successful exploitation of this vulnerability allows an attacker to install and activate malicious plugins, which effectively grants them the ability to execute arbitrary code within the WordPress environment. This constitutes a total loss of confidentiality, integrity, and availability, as the attacker can exfiltrate sensitive customer data, deface the marketplace, or deploy ransomware. Given the CVSS score of 7.2, this flaw poses a high risk to the operational continuity and security posture of the affected e-commerce platform.

Immediate Action: Update the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin to version 5.0.14 or later immediately.

Proactive Monitoring: Review WordPress administrative logs for unauthorized plugin installations or activations performed by accounts that should not possess such permissions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block suspicious REST API requests targeting plugin management endpoints if an immediate update is not feasible.

Public Exploit Available: Unknown

This vulnerability represents a significant security oversight that exposes the underlying WordPress installation to complete takeover. Administrators must prioritize updating the Dokan plugin to version 5.0.14 to close the access control gap and prevent unauthorized administrative actions. Failure to patch this vulnerability leaves the platform susceptible to malicious code execution and data breach scenarios.