CyberRota Analysis
AI-GeneratedThe Dokan plugin for WordPress is vulnerable to privilege escalation due to a missing authorization check in the CustomersController REST controller, allowing authenticated attackers with Vendor/Seller-level access to manipulate any WordPress user, including administrators. This vulnerability enables attackers to perform unauthorized actions such as reading, modifying, or deleting user accounts, potentially leading to a full site takeover. WordPress site administrators and those using the Dokan plugin should prioritize patching this vulnerability to mitigate the risk of unauthorized access and control over their sites.
Original NVD Description
The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the `CustomersController` REST controller (`includes/REST/CustomersController.php`), which re-registers WooCommerce's customer CRUD routes under the `/dokan/v1/customers/` namespace and replaces WooCommerce's native `manage_woocommerce` capability check with a vendor-only check that inspects the **requesting** user's role and never validates the **target** user. This makes it possible for authenticated attackers with Vendor/Seller-level access and above to read, modify, or delete any WordPress user — including administrators — via `GET`/`PUT`/`DELETE` requests against `/wp-json/dokan/v1/customers/{id}`. Setting the `password` parameter on an administrator's record yields a full site takeover.