CyberRota Analysis
AI-GeneratedThe Dokan plugin for WordPress versions prior to 5.0.14 is vulnerable as it fails to validate the payment amount provided by vendors against their actual outstanding balance during reverse-withdrawal transactions. This flaw allows vendors to manipulate their reverse-withdrawal ledger, potentially enabling them to eliminate legitimate commission debts without making the required payments. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of financial exploitation.
Original NVD Description
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal ledger with an arbitrary amount and clear their real commission debt without paying.