Dokan Pro: A security weakness
Dokan Pro is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
- Component
- Dokan Pro
- Plugin slug
dokan-pro- Affected
- See vendor advisory
- Safe version
- See mitigation notes
- Published
- Dec 16, 2025
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Dec 16, 2025 and is one of 11 known issues for this plugin.
Patch or disable the affected component.
Update Dokan Pro to a release outside the affected range, or disable and remove it until a fixed version is available.
Technical description
The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST API endpoint in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to enumerate users and retrieve their email addresses via the REST API by providing a user ID, along with other information such as usernames, display names, user roles, and registration dates.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N