Atomic Edge analysis of CVE-2026-8761 (metadata-based):
This vulnerability affects the Dokan plugin for WordPress, versions up to and including 5.0.2. It is a Missing Authorization flaw (CWE-862) with a CVSS score of 8.8. The affected component is the `CustomersController` REST controller at `includes/REST/CustomersController.php`. This controller re-registers WooCommerce’s customer CRUD routes under the `/dokan/v1/customers/` namespace and replaces WooCommerce’s native `manage_woocommerce` capability check with a vendor-only check that inspects the requesting user’s role but never validates the target user. As a result, an authenticated attacker with Vendor/Seller-level access can read, modify, or delete any WordPress user, including administrators. Setting the `password` parameter on an administrator record leads to a full site takeover. Atomic Edge analysis confirms the vulnerability allows privilege escalation through the REST API, with high impact on confidentiality, integrity, and availability.
Root Cause:
The root cause is a missing authorization check in the `CustomersController` class. The controller registers REST routes for customer CRUD operations and calls a permission callback that only verifies the requesting user has a vendor/seller role. It does not check whether the target user ID belongs to the same vendor or whether the requestor has permission to manage that specific user. Atomic Edge analysis infers this from the CWE-862 classification and the vulnerability description. The description states the permission check inspects the requesting user’s role but never validates the target user. This is consistent with a common WordPress REST API authorization flaw where the permission callback returns true for any authenticated user with a certain role, regardless of the resource owner. The missing check likely applies to the `get_item`, `update_item`, and `delete_item` methods, since the description mentions GET, PUT, and DELETE requests. Atomic Edge analysis cannot confirm the exact code without a diff, but the described behavior is sufficient to identify the flaw.
Exploitation:
An attacker with Vendor/Seller-level access can exploit this vulnerability by sending authenticated HTTP requests to the Dokan REST API. The attack vector uses the standard WordPress REST API endpoint at `/wp-json/dokan/v1/customers/{id}`. For enumeration, the attacker issues a GET request to fetch the target user’s profile. For modification, the attacker sends a PUT request with JSON body containing the target user ID and desired fields, such as `email`, `role`, or `password`. Setting the `password` field on an administrator’s user record allows the attacker to change that administrator’s password and then log in as that administrator. For deletion, the attacker sends a DELETE request to the same endpoint with the target user ID. The attacker only needs a valid WooCommerce vendor or seller account, which is typically obtainable through self-registration if the store allows it. Atomic Edge analysis confirms that the attack does not require any nonce or additional privileges beyond the vendor role.
Remediation:
The fix likely requires adding proper authorization checks to the `CustomersController` REST permission callbacks. The permission callback should verify that the requesting user has the appropriate capability, such as `manage_woocommerce` or a capability that restricts access to only the vendor’s own customers. Additionally, the controller should validate that the target user ID belongs to the vendor or is otherwise permitted to be accessed. Atomic Edge analysis recommends implementing a capability check per request, maybe using `current_user_can` with a valid capability like `edit_users` or a custom vendor capability, and validating the target user exists. The patch released in version 5.0.3 presumably addresses this issue by adding these checks. Atomic Edge analysis cannot confirm the exact modification without the diff, but the remediation aligns with standard WordPress authorization patterns.
Impact:
Successful exploitation allows an authenticated Vendor/Seller to read, modify, or delete any user account, including administrators. Reading user data exposes sensitive profile information, such as email addresses, usernames, and hashed passwords. Modifying an administrator’s password allows the attacker to take over the administrator account and gain full control over the WordPress site, leading to arbitrary file upload, plugin installation, theme modification, and potentially remote code execution. Deleting users can cause denial of service and data loss. The CVSS vector indicates high impact on confidentiality, integrity, and availability with a score of 8.8. Atomic Edge analysis confirms this is a critical privilege escalation vulnerability that can result in complete site compromise.
