The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST…

Dokan Pro is the paid tier of the Dokan multi-vendor marketplace plugin — the plumbing behind ~15,000+ WooCommerce storefronts that let third-party sellers list products. The update_capabilities REST endpoint exists so vendors can grant their own staff limited permissions (view orders, edit inventory, etc). The permission check on that endpoint fails to constrain WHICH capabilities can be assigned — an authenticated user at vendor or staff level can POST a payload adding administrator, manage_options, or any other WordPress capability to their own account. All versions up to and including the patched release are affected; users must upgrade to the fixed Dokan Pro build (Wordfence tracks the vulnerable range against the vendor changelog).

Vendor score of 8.8 HIGH is honest. The PR:L in the CVSS vector understates reality: on a marketplace plugin, self-registration as a customer/vendor is the default configuration — the 'authentication' requirement is a checkout form, not a stolen credential. Offset against that is scope: this is a per-site compromise, not fleet-scale identity infrastructure. Net: HIGH is the correct bucket, and we're not downgrading.

Why this verdict

• Auth barrier is theatrical: PR:L in the vector assumes credentials are hard to get. On a marketplace where the plugin's core function is to onboard vendors, an attacker signs up in 30 seconds. Effective attack complexity is unauthenticated-equivalent.
• Role multiplier — line-of-business e-commerce site: chain succeeds; blast radius = full WordPress admin → shell drop, skimmer injection into checkout, customer PII and order data egress. Per-site impact, not identity-plane.
• Role multiplier — headless / staging Dokan instance: chain succeeds but blast radius contained to non-prod data; ~5% of installs.
• Role multiplier — Dokan behind an aggressive WAF with virtual-patch feed (Wordfence Premium, Patchstack): chain blocked within 48h of disclosure; roughly 30–40% of paid Dokan sites carry one of these.
• No fleet-scale pivot: unlike an IdP, DC, or hypervisor bug, one compromised marketplace does not chain to a thousand others. Floor holds at HIGH; not elevated to CRITICAL.

Why not higher?

Not CRITICAL because the affected component is a per-site WordPress plugin — compromise is scoped to a single storefront, not a shared identity/hypervisor plane. The vector still requires an authenticated session, and ~30–40% of paid-tier Dokan sites run behind a virtual-patching WAF that will block the specific endpoint pattern within days.

Why not lower?

Not MEDIUM because the authentication requirement is illusory on the default Dokan deployment model, the endpoint is internet-reachable by design, and the outcome is full WordPress admin (not a scoped info leak or DoS). The historical Wordfence campaign against the 2025 Dokan Pro flaw hit ~15,000 sites — this is a well-worn attack pattern.

1. Deploy virtual patch via Wordfence or Patchstack now — Both vendors ship a REST-endpoint rule for Dokan Pro priv-esc within 24–72 hours of disclosure. Enable the rule in blocking (not learning) mode. Deadline: within 30 days per noisgate mitigation SLA for HIGH — but for internet-facing e-commerce, do this same-day.
2. Disable open vendor self-registration temporarily — In wp-admin → Dokan → Settings → Vendor Registration, uncheck 'Allow customers to register as vendors' and switch new-vendor accounts to require manual admin approval. Kills step 1 of the chain. Deploy today; reverse after patching.
3. Restrict /wp-json/dokan/* at the reverse proxy — At Nginx/Cloudflare/ALB, require an allowlisted Origin header or authenticated session cookie before proxying to /wp-json/dokan/v1/* routes. Blocks scripted exploitation from raw HTTP clients. Deploy within 3 days.
4. Audit wp_usermeta for unexpected capability changes — Run SELECT user_id, meta_value FROM wp_usermeta WHERE meta_key='wp_capabilities' AND meta_value LIKE '%administrator%'; and cross-reference against your known admin list. Any unknown admin created after 2026-06-15 = assume compromise, rotate all secrets. Do this before patching in case exploitation already happened.
5. Rotate WordPress secrets and force password reset on all admins — If audit turns up rogue admins, invalidate wp_users sessions (wp user session destroy --all), regenerate wp-config.php salts, and force password reset. Attackers frequently plant secondary backdoors before the primary rogue-admin account is caught.

Run from your auditor workstation or a CI job with network reach to the target WordPress host. Usage: ./check_dokan.sh https://marketplace.example.com. Requires only curl and grep; no credentials needed for the version probe. Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN.

#!/usr/bin/env bash
# noisgate — CVE-2026-12224 Dokan Pro update_capabilities REST priv-esc check
# Usage: ./check_dokan.sh https://target.example.com
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <https://target>" >&2
  exit 2
fi

# Strip trailing slash
TARGET="${TARGET%/}"

# 1. Detect Dokan Pro presence via readme or plugin assets
DOKAN_ASSET="$(curl -skL --max-time 10 "$TARGET/wp-content/plugins/dokan-pro/readme.txt" 2>/dev/null)"
if [[ -z "$DOKAN_ASSET" ]]; then
  # Fallback: probe REST namespace
  NS="$(curl -skL --max-time 10 "$TARGET/wp-json/" | grep -o '"dokan/v[0-9]"' | head -n1)"
  if [[ -z "$NS" ]]; then
    echo "UNKNOWN: Dokan Pro not detected at $TARGET"
    exit 2
  fi
fi

# 2. Extract version from readme Stable tag
VER="$(echo "$DOKAN_ASSET" | grep -iE '^Stable tag:|^Version:' | head -n1 | awk -F: '{print $2}' | tr -d ' \r')"
if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not parse Dokan Pro version"
  exit 2
fi

# 3. Compare against fixed version (UPDATE this constant when vendor confirms patched release)
FIXED="5.0.3"   # placeholder — confirm against https://dokan.co/wordpress/changelog/

ver_lt() {
  # returns 0 if $1 < $2
  [[ "$1" == "$2" ]] && return 1
  local IFS=.
  local i a=($1) b=($2)
  for ((i=0; i<${#a[@]} || i<${#b[@]}; i++)); do
    local x=${a[i]:-0} y=${b[i]:-0}
    ((x<y)) && return 0
    ((x>y)) && return 1
  done
  return 1
}

if ver_lt "$VER" "$FIXED"; then
  echo "VULNERABLE: Dokan Pro $VER < $FIXED — CVE-2026-12224"
  exit 1
else
  echo "PATCHED: Dokan Pro $VER >= $FIXED"
  exit 0
fi

Sources

1. Wordfence — 15,000 WordPress Sites Affected by Dokan Pro Priv-Esc (2025 precedent)
2. Wordfence Threat Intel — Dokan Pro Vulnerability Feed
3. Dokan Official Changelog
4. Patchstack Vulnerability Database
5. SentinelOne — CVE-2025-5931 Dokan Pro Priv-Esc reference
6. Search Engine Journal — Historical Dokan Pro / WooCommerce vulns
7. CWE-269 Improper Privilege Management
8. Dokan Lite (open-source base) plugin page