A missing authorization flaw in the Dokan plugin for WordPress allows authenticated users with low privileges to escalate their access level.

The plugin fails to implement proper capability checks within its REST API controllers, allowing an authenticated user to perform unauthorized actions. This constitutes a missing authorization vulnerability (CWE-862).

With a CVSS score of 8.8, this vulnerability allows an attacker to gain elevated privileges within the WordPress environment. This could lead to unauthorized administrative control over the WooCommerce marketplace, resulting in data theft, modification of store settings, or full administrative takeover of the WordPress site.

Immediate Action: Monitor for updates to the Dokan plugin and apply the patch as soon as it is released by the vendor.

Proactive Monitoring: Monitor WordPress audit logs for unexpected privilege changes or administrative actions performed by low-privileged user accounts.

Compensating Controls: If a patch is unavailable, consider restricting access to the affected REST API endpoints via a WAF or disabling the plugin until a fix is deployed.

Public Exploit Available: false

Given the high impact of privilege escalation, security teams should actively monitor the plugin vendor for a patched version. Until a resolution is available, limit the creation of new user accounts and audit existing user roles for suspicious activity.