CVE-2026-16574

Executive Summary

CVE-2026-16574 is an authorization bypass vulnerability in the Dokan WordPress plugin (AI Powered WooCommerce Multivendor Marketplace Solution) affecting versions prior to 5.0.11. The flaw resides in an order REST endpoint that fails to verify a downloadable product's ownership by the requesting vendor before granting download permissions. An authenticated vendor can exploit this to grant their own customers unauthorized free download access to another vendor's paid downloadable files, enabling content theft and revenue loss across the marketplace. Organizations operating Dokan-based multivendor marketplaces must prioritize patching to versions ≥5.0.11 to mitigate financial and operational damage.

Technical Analysis

The vulnerability exists in Dokan's REST API implementation for order management. Within the plugin's order endpoints, a vendor is permitted to manage and grant download permissions for products associated with their own orders. The affected code path lacks a critical ownership verification check — specifically, it fails to validate that the downloadable product's vendor ID (post_author or meta-field vendor association) matches the currently authenticated vendor's ID.

The vulnerable flow is as follows:

• Dokan registers custom REST routes (typically under /wp-json/dokan/v1/orders/{order_id}/) that handle order-related operations.
• One endpoint, designed to add or modify download permissions for a customer, retrieves the product ID from the request body.
• The endpoint then calls a function similar to wc_customer_bought_product() or directly inserts a download permission record into the WooCommerce woocommerce_downloadable_product_permissions table.
• Critically, no validation is performed to confirm the product belongs to the vendor's own catalog. A vendor can supply an arbitrary product_id belonging to another vendor.

The lack of a server-side check such as vendor_id === get_post_field('post_author', $product_id) means the permission grant succeeds regardless of ownership. This is an IDOR (Insecure Direct Object Reference) combined with a missing authorization check (CWE-639/CWE-862 class), though the exact CWE is not listed by NVD.

Attack surface: Authenticated vendor users (role seller or vendor) with access to the WordPress REST API. The endpoint is likely accessible over HTTP/HTTPS without CSRF token requirements since it is a REST route. Exploitation requires low privilege (vendor account) and no special network access beyond standard WordPress exposure.

Affected versions: All Dokan versions before 5.0.11. The patch in 5.0.11 presumably adds the missing vendor ownership validation.

Exploitation Scenarios

Step-by-step attack chain:

1. Reconnaissance/Identification: The attacker registers for a vendor account on a Dokan-powered marketplace (self-registration is typical in multivendor platforms). Alternatively, they compromise/existing low-privileged vendor credentials. They identify a high-value paid digital product from a competitor vendor by browsing the marketplace (e.g., product ID 500 — "Premium E-Book Pack").

2. Authentication & Token Acquisition: The attacker authenticates via the WordPress REST API. They need a WordPress nonce and their API credentials. Using the standard auth flow (wp-json/jwt-auth/v1/token with their vendor username/password, or a cookie nonce for the REST namespace).

3. Finding a Victim Order: The attacker identifies (or creates) a customer account under their control. They determine an order ID for their own product (e.g., order 1234 that purchased their $5 competitor sample). This order exists within their vendor scope and grants API access.

4. Crafting the Malicious Request: The attacker sends an authenticated REST API request to the vulnerable endpoint. Example:

   POST /wp-json/dokan/v1/orders/1234/downloads
   Content-Type: application/json
   Authorization: Bearer <attacker_jwt_token>
   
   {
     "product_id": 500,
     "customer_id": 42,
     "download_id": ""
   }
   

   The product_id field points to the competitor's product (ID 500), customer_id is the attacker's controlled customer, and the empty download_id triggers creation of a new permission record.

5. Execution: The server-side handler inserts a row into woocommerce_downloadable_product_permissions linking customer 42 to product 500, without checking that order 1234 actually contains product 500 or that the vendor owns it.

6. Post-Exploitation: The attacker logs in as customer 42 and visits the WooCommerce "My Account → Downloads" page. They can now download the premium digital files that should only be accessible to legitimate purchasers of vendor B's product. The attacker can redistribute, resell, or leak the files. They can repeat for multiple product IDs, enabling mass-scale exfiltration.

Impact chain: The attack directly causes revenue loss for the victim vendor (lost sales), intellectual property theft, and potential reputational damage to the marketplace if premium content is leaked publicly. In a scenario where a malicious vendor uses a single compromised vendor account, the blast radius covers all paid downloadable content across the entire marketplace.

Impact Assessment

Business Impact: High. Documented phishing campaigns and content theft directly translate into financial loss — every unauthorized download represents a lost sale for the victim vendor. For marketplace operators, this erodes trust and can lead to vendor churn, legal disputes, and declined renewals.

Affected Systems: Any WordPress site running Dokan versions < 5.0.11 with the WooCommerce integrator, where at least one vendor offers paid downloadable products. Even a single vulnerable endpoint can be exploited by any authenticated vendor account.

Blast Radius: Multiple vendors' digital catalogs in a single marketplace can be compromised simultaneously. Complete confidentiality loss of proprietary digital assets (ebooks, software, media files, licensing materials).

CVSS Subscores: CVSS score not assigned by NVD. Based on the vulnerability mechanics, a reasonable estimate would be in the Medium–High range (6.5–8.0) given low attack complexity, low privilege requirement, and significant confidentiality impact, but no official vector discloses.

Detection Guidance

Sigma Rule

title: Dokan REST API Vendor Download Permission Abuse
id: 5c3a7d20-1a4e-4d88-9e37-5b1a0e9f7d22
status: experimental
description: Detects authenticated REST API requests targeting Dokan order endpoints with a product_id that does not match the order's contents, indicating unauthorized download permission grants.
logsource:
  category: webserver
  product: apache
  service: access-log
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains:
      - '/wp-json/dokan/v1/orders/'
      - '/downloads'
  filter_known:
    cs-uri-query|contains:
      - '/wp-json/dokan/v1/orders/'
    c-uri-query|re: '.*product_id=([0-9]+).*'
  condition: selection and not filter_known
fields:
  - src_ip
  - c-uri-query
  - sc-status
falsepositives:
  - Legitimate admin actions adding download permissions (rare)
level: medium

YARA Rule

rule Dokan_Vendor_DownloadPermission_Exploit
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects HTTP request patterns targeting the vulnerable Dokan REST endpoint"
        date = "2026-01-15"
        reference = "CVE-2026-16574"
    strings:
        $endpoint = "/wp-json/dokan/v1/orders/" ascii wide
        $download_ops = "/downloads" ascii wide
        $auth_header = "Authorization: Bearer" ascii wide nocase
        $json_key = "product_id" ascii wide nocase
        $guest_key = "customer_id" ascii wide nocase
    condition:
        all of them and filesize < 10KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-16574 Dokan Vendor Download Permission Abuse Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/wp-json/dokan/v1/orders/"; http_uri; content:"/downloads"; http_uri; pcre:"/product_id\":\s*\"\d+/Ui"; sid:202616574; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where destination.port == 443 and
    http.request.method == "POST" and
    url.path in ("/wp-json/dokan/v1/orders/*") and
    url.path like "*/downloads" ]
  [ http where http.request.body_bytes > 0 and
    http.request.body.content contains "product_id" and
    http.request.body.content contains "customer_id" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%/wp-json/dokan/v1/orders/%") 
  AND like(uri_path, "%/downloads")
  AND method="POST"
| rex field=uri_path "orders/(?<order_id>\d+)/downloads"
| rex field=_raw "product_id\D+(?<product_id>\d+)"
| rex field=_raw "customer_id\D+(?<customer_id>\d+)"
| stats count by src_ip, order_id, product_id, customer_id, useragent
| where count > 1

Wazuh OSSEC Rule

<group name="web,wordpress,dokan,">
  <rule id="100002" level="8">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="url">\./wp-json/dokan/v1/orders/.*/downloads</field>
    <description>Dokan vendor download permission abuse attempt (CVE-2026-16574)</description>
    <group>attack_id=T1190</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (apply now):

   • If immediate patching is not possible, disable vendor REST API access via .htaccess or a WAF rule blocking POST /wp-json/dokan/v1/orders/*/downloads from non-admin IPs.
   • Restrict vendor role capabilities using a security plugin (e.g., disable the dokan_manage_order_downloads capability if available).
   • Enable two-factor authentication for all vendor accounts to hinder account compromise.
   • Monitor vendor API logs and alert on any POST to the order downloads endpoint with a product ID not present in the order.

2. Patch/Upgrade Steps:

   • Upgrade the Dokan plugin to version 5.0.11 or later as soon as possible. This is the minimum patched version per NVD.
   • Verify the upgrade by checking the plugin changelog for the fix containing references to "vendor download permission validation."
   • After upgrading, test the endpoint by attempting to grant download access to a product ID outside your vendor scope — it should be rejected with a 403 response.

3. Long-Term Hardening:

   • Subscribe to vendor security announcements (weDevs/Dokan official channels).
   • Implement a regular patch cadence for all WordPress plugins, prioritizing marketplace-critical extensions.
   • Conduct periodic security reviews of any REST endpoint customization performed on the marketplace.
   • Enforce least-privilege principles — vendors should only see and interact with their own products and orders.
   • Consider deploying a WAF with virtual patching for known vulnerable plugin signatures.
   • Document the vulnerability in your risk register and include vendor download abuse in your incident response playbook.

References

1. NVD Entry for CVE-2026-16574: https://nvd.nist.gov/vuln/detail/CVE-2026-16574 (primary patch claim source)
2. Dokan Plugin Official Changelog: https://wedevs.com/docs/dokan/changelog/ (version 5.0.11 release notes)
3. WordPress Plugin Repository – Dokan: https://wordpress.org/plugins/dokan-lite/ (affected plugin distribution)
4. CWE-639 – Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html (vulnerability class reference)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (confirmed NOT listed as of publication date — no known exploitation-in-the-wild reported)