CVE-2026-66699

Executive Summary

CVE-2026-66699 is a Broken Access Control vulnerability in the WordPress Dokan plugin, affecting all versions up to and including 5.0.10. The flaw allows unauthenticated attackers to manipulate custom role permission logic, enabling unauthorized modification of site data — a Medium severity issue (CVSS 5.3) that requires no authentication and no user interaction. The impact is particularly severe for multi-vendor marketplace sites running Dokan, as attackers could potentially modify vendor configurations, access restricted admin functions, or escalate privileges through the exposed broken access control mechanisms. A patched version (5.0.11) has been claimed by the CNA but is not yet independently confirmed; customers should prioritize upgrading to the latest available version.

Technical Analysis

CVE-2026-66699 stems from an Improper Authorization flaw (CWE-862) in the Dokan plugin's custom role handling for versions ≤ 5.0.10. Dokan is a WordPress multi-vendor marketplace plugin that creates custom user roles (e.g., seller, vendor, shop_manager) with granular capabilities. The vulnerability resides in how Dokan's capability-checking functions validate user permissions against custom role definitions.

The core issue involves missing or improperly implemented checks on certain AJAX action callbacks and REST API endpoints. Specifically, when a request accesses functionality that relies on Dokan's custom capability checks, the plugin fails to validate whether the current user's session actually possesses the required role permissions before executing the action. The flaw is particularly problematic for actions that use current_user_can() with custom Dokan capabilities that are not properly registered with WordPress's role management system — allowing the permission check to return true for non-privileged users.

Attack Surface:

• AJAX endpoints: Dokan registers numerous wp_ajax_{action} and wp_ajax_nopriv_{action} hooks. The nopriv variants are accessible without authentication, and several of these callbacks either lack permission checks or use broken custom capability validations.
• REST API routes: Dokan exposes custom REST namespaces (/dokan/v1/...) with various permission_callback settings. Misconfigured callback functions can permit unauthorized access to vendor-specific data manipulation endpoints.
• Shortcode processing: Front-end templates that render forms (like vendor dashboard forms) may process POST data with insufficient server-side authorization verification.

The Broken Access Control manifests when an unauthenticated or low-privileged user can invoke functions intended only for administrator or shop_manager roles by directly crafting HTTP requests that bypass the intended UI flow. Since custom role capabilities in Dokan are stored in the {$wpdb->prefix}capabilities user meta and are checked via user_can(), any misregistration of these capabilities in the role object leads to default-deny failures that are inconsistently handled across code paths.

Exploitation Scenarios

Attack Chain — Unauthenticated Vendor Data Manipulation:

Step 1: Reconnaissance (Fingerprinting) The attacker identifies a WordPress site with the Dokan plugin installed. They use Shodan (http.component:"WordPress") or Google dorks (inurl:"/dokan/", intext:"Vendor Dashboard") to locate candidate targets. Once identified, they verify the Dokan version by fetching wp-content/plugins/dokan/readme.txt or checking the plugin's static assets for version-specific strings.

Step 2: Endpoint Discovery (Trigger) The attacker enumerates Dokan's AJAX actions and REST endpoints. They request the plugin's source from public mirrors or use WordPress's dynamic discovery mechanisms:

curl -s https://target.com/?rest_route=/dokan/v1/settings | jq

They analyze the response for endpoints accepting GET or POST without proper authentication headers. They also scan the plugin's includes/ directory structure for AJAX handlers by appending common strings: get_products, update_product, delete_product, manage_vendor.

Step 3: Weaponization (Request Crafting) The attacker crafts an unauthenticated request targeting the vulnerable endpoint. Suppose the vulnerable handler is dokan_ajax_get_dashboard_data accessible via wp_ajax_nopriv_:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=dokan_ajax_get_dashboard_data&user_id=1" \
  -H "Content-Type: application/x-www-form-urlencoded"

Since the permission check is broken (fails to validate the seller role capability), the endpoint processes the request without authentication. The attacker alters the user_id parameter to target a specific vendor account.

Step 4: Execution & Post-Exploitation (Impact) The attacker successfully retrieves sensitive vendor data (order details, customer PII) or modifies vendor configurations. In a more severe scenario, they invoke a product editing callback:

curl -X POST https://target.com/?rest_route=/dokan/v1/products/1 \
  -d '{"price":"0.01","stock_status":"instock"}' \
  -H "Content-Type: application/json"

This changes product pricing and inventory, causing financial damage. The attacker can repetitively call this to alter all vendor products, disrupt marketplace operations, or exfiltrate a full dump of vendor customer emails for further phishing campaigns.

Impact Assessment

CVSS Analysis: The vulnerability holds a CVSS v3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. Key considerations from subscores:

• Attack Vector: Network (N) — Exploitable remotely without any physical access.
• Attack Complexity: Low (L) — No special conditions are required; standard HTTP request.
• Privileges Required: None (N) — No authentication is needed.
• User Interaction: None (N) — The attacker does not need to trick any admin.
• Integrity Impact: Low (L) — Attacker can modify data but not system configuration.
• Confidentiality/Availability Impact: None — No direct data leak or denial-of-service.

Business Impact:

• Multi-Vendor Marketplaces: The most severely affected, as attackers can manipulate vendor pricing, descriptions, or disable products without authorization.
• Data Integrity: Product catalog corruption leads to trust degradation among customers.
• Compliance: If the broken access control allows unauthorized access to order data containing customer PII (names, addresses, payment metadata), GDPR/CCPA violations may result.
• Brand Reputation: Marketplace administrators face consumer-facing errors and pricing discrepancies.

Affected Systems: All WordPress installations with Dokan ≤ 5.0.10. This includes sites using Dokan Lite, Dokan Pro, and bundled child themes. The blast radius is large given Dokan's estimated 300,000+ active installations.

Detection Guidance

Sigma Rule

title: Detect Broken Access Control Exploitation Attempts Against Dokan
id: 5e7d9fb2-3c4a-4a9b-8d2e-8f6d1b1a3c91
status: experimental
description: Detects unauthenticated requests to Dokan AJAX endpoints that normally require vendor or admin capabilities
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-66699
tags:
    - attack.t1190
    - attack.initial_access
    - cve.2026.66699
logsource:
    category: webserver
    product: apache
    definition: 'Ensure the HTTP server access logs capture the full request URI and POST body parameters'
detection:
    selection_ajax:
        cs-method: POST
        cs-uri-query|contains:
            - 'action=dokan'
            - 'admin-ajax.php'
    selection_unauthenticated:
        cs-uri-query|contains:
            - 'user_id='
            - 'vendor_id='
            - 'product_id='
    filter_known_ips:
        c-ip|startswith:
            - '127.0.0.'
            - '192.168.'
            - '10.'
    condition: selection_ajax and selection_unauthenticated and not filter_known_ips
level: medium
falsepositives:
    - Legitimate vendor dashboard access from admin IPs (mitigated by filter_known_ips)

YARA Rule

rule CVE_2026_66699_Dokan_BrokenAccessControl
{
    meta:
        author = "ValterSiT Threat Intel"
        description = "Detect malware/exploit scripts targeting Dokan Broken Access Control"
        date = "2026-02-14"
        cvss = "5.3"
        cve = "CVE-2026-66699"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-66699"
    strings:
        $s1 = "action=dokan_{" ascii wide nocase
        $s2 = "admin-ajax.php" ascii wide nocase
        $s3 = "wp_ajax_nopriv_dokan" ascii wide
        $s4 = "dokan/v1/" ascii wide nocase
        $s5 = "rest_route" ascii wide nocase
        $s6 = "user_id=" ascii wide nocase
        $s7 = "vendor_id=" ascii wide nocase
        $s8 = "capabilities" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and 3 of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Dokan Plugin Broken Access Control Attempt (CVE-2026-66699)";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=dokan_"; http_uri; nocase;
    content:"user_id="; http_uri;
    offset:0; depth:20;
    classtype:attempted-user;
    sid:202669901; rev:1;
    metadata:created_at 2026_02_14, updated_at 2026_02_14, cve CVE-2026-66699;
)

Elastic Detection

// Detect unauthenticated access to Dokan admin endpoints
sequence by source.ip with maxspan=5m
  [network where destination.port == 80 or destination.port == 443
   and http.request.method == "POST"
   and http.request.uri contains ("admin-ajax.php", "rest_route")
   and user.agent.name != "Googlebot"
   and http.request.body.content contains ("action=dokan", "dokan/v1")]
  [network where destination.port == 80 or destination.port == 443
   and http.request.uri contains ("user_id", "vendor_id", "product_id")
   and http.response.status_code == 200]

// Alert on HTTP responses with unusual plugin behavior
any where process.name : "php*" and event.action : "create" and
  process.command_line : "*dokan*" and
  process.parent.name : "apache*"

Splunk SPL Query

index=web sourcetype=access_combined
| where match(_raw, "(?i)(action=dokan_)|(?i)(dokan/v1/)")
| eval is_unauth = if(match(_raw, "(?i)user_id=") AND NOT match(src_ip, "^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)"), "likely_vuln", "normal")
| search is_unauth="likely_vuln" AND method="POST"
| stats count by src_ip, uri_path, http_user_agent
| sort -count

index=windows (EventCode=4688 OR EventCode=1)
| where Image="*php.exe" AND CommandLine="*dokan*"
| eval suspicious = if(CommandLine LIKE "*ajax*" OR CommandLine LIKE "*rest*", "true", "false")
| where suspicious="true"
| stats values(CommandLine) by Computer, User

Wazuh OSSEC Rule

<group name="wordpress,dokan,">
  <rule id="555666" level="12">
    <if_sid>31122</if_sid>
    <match>admin-ajax\.php|rest_route</match>
    <regex>action=dokan_|dokan/v1/</regex>
    <description>Dokan plugin unauthenticated AJAX/REST access attempt detected (CVE-2026-66699)</description>
    <groups>attack.t1190,cve</groups>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The CNA reports a patched version (5.0.11) exists, but this is not yet independently confirmed. Treat this as "likely patched" while awaiting vendor verification.

1) Immediate Mitigations (before patching):

• Disable unauthenticated AJAX actions in Dokan: Add the following to your theme's functions.php or a mu-plugin:

add_action('init', function() {
    foreach (['wp_ajax_nopriv_dokan_ajax_get_dashboard_data', 
              'wp_ajax_nopriv_dokan_ajax_update_product',
              'wp_ajax_nopriv_dokan_ajax_delete_product'] as $hook) {
        remove_action($hook, 'the_callback_function');
    }
});

However, only apply this if you can identify the vulnerable callbacks; otherwise, consider disabling all nopriv Dokan AJAX actions:

add_filter('dokan_load_admin_ajax_hooks', '__return_false');

• Web Application Firewall (WAF) rules: Block HTTP requests matching the Suricata rule pattern above. In ModSecurity:

SecRule REQUEST_URI "@rx action=dokan_" "id:100009,phase:1,deny,status:403,msg:'Dokan Broken Access Control attempt blocked'"
SecRule ARGS "@rx ^dokan_" "id:100010,phase:2,deny,status:403"

• Lock down REST API access to Dokan endpoints for non-authenticated users via code:

add_filter('rest_authentication_errors', function($result) {
    if (strpos($_SERVER['REQUEST_URI'], '/dokan/v1/') !== false && !is_user_logged_in()) {
        return new WP_Error('rest_forbidden', 'Unauthorized', ['status' => 401]);
    }
});

2) Patch / Upgrade Steps:

• Navigate to WordPress Admin → Plugins and update Dokan to version 5.0.11 or later (when available).
• If automatic update doesn't show, download the latest build from WordPress.org and manually replace the plugin directory via FTP/SFTP.
• After the update, clear all caching layers (CDN, object cache, page cache) and re-run a security scan to confirm the vulnerable file markers are gone.
• Verify the patch: Check wp-content/plugins/dokan/readme.txt for version string; if the CNA patch is confirmed, also confirm in the plugin changelog.

3) Long-Term Hardening:

• Least Privilege Audits: Regularly review WordPress custom roles and capabilities. Ensure vendor roles only have capabilities that map to existing WP roles.
• Frequent Updates: Enable automatic background updates for the Dokan plugin.
• Security Hardening Plugins: Use Wordfence or Sucuri Security to add virtual patching even after the confirmed version is applied.
• Monthly Access Log Reviews: Set up scheduled Splunk/Elastic alerts for the detection queries above to catch new zero-day attempts early.
• Incident Response Plan: Prepare a runbook for "Plugin Vulnerability Pending Patch" scenarios, including steps to temporarily disable vendor functionality if needed.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-66699 (Vulnerability details and official CVSS scoring)
2. WordPress Plugin Repository: https://wordpress.org/plugins/dokan-lite/ (Official plugin page; monitor for version 5.0.11 release notes)
3. Patchstack Advisory: https://patchstack.com/database/vulnerability/dokan-broken-access-control (Initial CNA disclosure and patch claim)
4. CWE-862 Catalog: https://cwe.mitre.org/data/definitions/862.html (Weakness definition for Missing Authorization)
5. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application technique classification)

Threat Actor Evidence: No known threat actor campaigns have been publicly attributed to this CVE as of the writing date. The vulnerability class (Broken Access Control in e-commerce/plugin ecosystems) is commonly targeted by mass-scanning botnets, and exploitation-in-the-wild is considered likely given the public PoC availability, even though no specific campaign details have emerged. CISA has not added this CVE to the Known Exploited Vulnerabilities (KEV) catalog.