Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.7
CVE-2026-107694: Dokan plugin lets sellers view other vendors' fees
CVE-2026-107694 · published 7 days ago
Summary
The Dokan marketplace plugin for WordPress does not check who is asking for commission details, so a seller can request and see the commission rate and fixed fee set for another seller. This could reveal pricing strategies and give an unfair advantage. Update the plugin to version 5.2.0 or later, or apply the vendor's patch, to stop this information from being disclosed.
What to do
- Update unknown dokan: ai powered woocommerce multivendor marketplace solution to version 5.2.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | dokan: ai powered woocommerce multivendor marketplace solution | < 5.2.0 |
Original advisory text
Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.7
Low
Type
CWE-200Information Exposure
Timeline
Published11 Oct 2026
Updated16 Oct 2026
First seen11 Oct 2026
Track software like this
Free during beta