CyberRota Analysis
AI-GeneratedThe Dokan plugin for WordPress, prior to version 5.0.9, is vulnerable due to insufficient verification of order ownership on a REST endpoint, enabling users with vendor accounts to alter the status of any WooCommerce order, including those belonging to other vendors and customers. This could lead to unauthorized order manipulation, potentially disrupting marketplace operations and undermining trust. WordPress site administrators using the Dokan plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk order-status changes, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace, including orders belonging to other vendors and the store's own customers.