Description
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution | < 5.0.14 | 5.0.14 |
References
- https://wpscan.com/vulnerability/801e9008-e912-4606-8c21-3d31dc0bd2c7/ exploit vdb-entry technical-description