CVE-2026-89280

Executive Summary

CVE-2026-89280 is an Insecure Direct Object Reference (IDOR) vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin, affecting all versions up to and including 5.2.1. An authenticated attacker holding vendor-level access (which can be self-registered via the public "I am a vendor" flow when enabled) can manipulate a user-controlled 'password' parameter to change the WordPress account password of any customer who has placed at least one order with the attacking vendor, resulting in limited account takeover. The vulnerability carries a moderate CVSS score of 4.3 and is not currently listed in CISA KEV, with no public PoC, Nuclei template, or exploit code observed.

Technical Analysis

CVE-2026-89280 is classified as CWE-639: Authorization Bypass Through User-Controlled Key, commonly referred to as Insecure Direct Object Reference (IDOR). The flaw resides in the Dokan WordPress plugin, which extends WooCommerce with multi-vendor marketplace functionality including vendor dashboards, order management, and customer interaction features.

Per the NVD description, the vulnerability is triggered through the 'password' parameter. The core defect is "missing validation on a user controlled key" — meaning the application accepts an identifier from the request that determines which account's password is modified, without verifying that the requesting vendor is authorized to modify that specific account.

The authorization model that should apply here is ownership-based: a vendor should only be permitted to act upon records (customers/orders) tied to their own storefront. Because the 'password' parameter acts as an object reference that the attacker can influence, a malicious vendor can supply a value referring to a customer account outside their legitimate scope — specifically any customer who has previously placed at least one order with that vendor. The requirement that the victim have placed at least one order implies the plugin's internal logic scopes the vulnerable operation to customers within the vendor's order history, but the authorization check on which specific customer is targeted is absent or insufficient.

Key exploitation preconditions derived from the description:

• The attacker must be authenticated with at least "custom-level access," and vendor-level access is the practical requirement.
• Vendor registration is self-service: if the "I am a vendor" option is enabled on the site, an attacker can obtain vendor-level privileges through the public registration flow without prior authorization.
• The targeted victim must have transacted at least once with the attacking vendor's storefront.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms network accessibility, low attack complexity, low privileges required, no user interaction, and limited integrity impact with no confidentiality or availability impact. Because the impact is scoped to unauthorized password modification (an integrity operation) rather than data disclosure, the C:N/I:L/A:N subscores are consistent.

No public proof-of-concept, Nuclei template, or exploit code has been observed for this CVE at the time of writing. The attack chain described below is therefore inferred from the vulnerability class and the details supplied by NVD. No specific function names, endpoints, or file paths beyond the 'password' parameter are confirmed, and none are fabricated here.

Exploitation Scenarios

The following attack chain is derived strictly from the NVD description. No public PoC exists; steps are described at the vulnerability-class level.

1. Reconnaissance / target identification: The attacker identifies a WordPress site running the Dokan multivendor plugin (observable via plugin-specific markup, marketplace pages, or vendor storefronts). The attacker confirms the "I am a vendor" registration option is enabled, which is the enabling condition for self-service vendor onboarding.

2. Privilege acquisition: The attacker uses the public "I am a vendor" registration flow to self-register a vendor account, obtaining the vendor-level access required to reach the vulnerable functionality. No prior trust relationship or administrative approval is assumed to be necessary when the option is enabled.

3. Establishing victim scope: The attacker ensures or identifies at least one customer who has placed an order with the attacker's vendor storefront. Where the attacker controls product listings, they may induce a victim to place such an order; alternatively, an existing customer who has already transacted with the store satisfies the precondition.

4. Triggering the IDOR: When submitting the request that updates or sets an account password, the attacker manipulates the 'password' parameter (the user-controlled key) to reference a victim customer account. Because the plugin performs no validation on this user-controlled key, the request is processed against the victim's account rather than being rejected or scoped to the attacker's own account.

5. Post-exploitation impact: The attacker successfully changes the WordPress account password of the targeted customer. This enables the attacker to log in as that customer — a limited account takeover. The scope is "limited" because the takeover is confined to customer-level accounts that fall within the vendor-order precondition, not administrative accounts.

Note: Because no PoC or template is public, no specific request payloads, endpoint paths, or parameter encodings are provided; the exact HTTP request structure is not disclosed in available data.

Impact Assessment

Business impact centers on unauthorized account takeover of customer accounts on a WooCommerce marketplace. An attacker-controlled vendor can seize control of customer logins for any customer who has transacted with them, enabling access to that customer's stored account details, order history, and any site features gated behind the customer role.

The CVSS v3.1 base score is 4.3 (Medium), with:

• Confidentiality: None (C:N) — the primary action is a password change, not data disclosure.
• Integrity: Low (I:L) — an account credential is modified without authorization, but scope does not extend to full system integrity.
• Availability: None (A:N) — no service disruption.
• Privileges Required: Low (PR:L) — vendor-level access is required but is self-obtainable.
• User Interaction: None (UI:N) — the victim need not take any action during exploitation.
• Scope: Unchanged (S:U) — impact stays within the vulnerable component's security authority.

Blast radius is bounded by the precondition that victims must have placed at least one order with the attacking vendor, which limits the set of takeover-eligible accounts. However, on a large marketplace, a vendor with a substantial customer base could potentially take over many accounts. The self-registration vector materially lowers the barrier to exploitation: any visitor can become a vendor (when the option is enabled), meaning the "low privilege" requirement is not a meaningful obstacle. Combined with no user interaction and low attack complexity, this makes automation of the attack chain plausible once a vendor account and qualifying order exist.

Detection Guidance

Sigma Rule

title: Dokan WooCommerce IDOR Password Change via User-Controlled Key
id: 8f4a2c1e-7b3d-4e9a-9c2f-dokan89280a
status: experimental
description: Detects attempts to exploit CVE-2026-89280 IDOR in Dokan plugin by a vendor manipulating the password parameter to target customer accounts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-89280
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: wordpress
  service: web
detection:
  selection_method:
    cs-method: 'POST'
  selection_endpoint:
    cs-uri-query|contains:
      - 'password'
  selection_plugin:
    cs-uri|contains: 'dokan'
  condition: selection_method and selection_plugin and selection_endpoint
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate vendor password-management functionality
level: medium

YARA Rule

rule CVE_2026_89280_Dokan_IDOR_Password
{
    meta:
        description = "Detects Dokan plugin code patterns referenced by CVE-2026-89280 IDOR in the password parameter"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-89280"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $dokan = "dokan" ascii nocase
        $pwd_param = "'password'" ascii nocase
        $vendor = "vendor" ascii nocase
        $wc_pass = "wp_set_password" ascii nocase

    condition:
        $dokan and $pwd_param and ($vendor or $wc_pass)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-89280 Dokan WooCommerce IDOR Password Change Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"dokan"; nocase; http.request_body; content:"password"; nocase; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-89280; classtype:attempted-user; sid:8928001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ http where http.request.method == "POST" and url.path contains "dokan" ]
  [ http where http.request.method == "POST" and url.query contains "password" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri_path="*dokan*" uri_query="*password*"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_path) as paths values(uri_query) as queries
        by src_ip, user_agent, status
| where count > 0

Wazuh OSSEC Rule

<group name="web,wordpress,dokan,">
  <rule id="892800" level="10">
    <if_sid>31100</if_sid>
    <id>^POST$</id>
    <url>dokan</url>
    <description>CVE-2026-89280 - Possible Dokan IDOR password change attempt detected</description>
    <group>cve_2026_89280,idor,account_takeover,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The NVD entry indicates a fix exists, but no fixed version number, vendor advisory, or changelog was provided, so the availability of a definitive patched release cannot be independently confirmed.

1. Immediate mitigations:

• If the "I am a vendor" self-registration flow is not operationally required, disable it to eliminate the easy privilege-acquisition path. Requiring administrator approval for new vendors reduces the pool of potential attackers.
• Restrict vendor account creation and review existing vendor accounts for unexpected or recently self-registered entries.
• As a compensating control, enforce additional server-side authorization checks on any password-change functionality that references a customer account, ensuring the acting vendor is scoped only to their own legitimate customers.
• Consider temporarily disabling the Dokan plugin if the vulnerability cannot be mitigated and marketplace operations permit.

2. Patch/upgrade steps:

• Monitor the official Dokan/WooCommerce plugin channels and the WordPress plugin repository for a release newer than 5.2.1. The claimed fix should be validated by checking the vendor changelog for an authorization or security entry addressing the 'password' parameter.
• Once a fixed version is confirmed, stage and test the upgrade in a non-production environment, then deploy to production.
• Because patch confidence is only CLAIMED from a single source, independently verify the fix with the vendor before relying on it.

3. Long-term hardening:

• Implement and maintain defense-in-depth authorization: every operation acting on a user-controlled key must validate that the key refers to an object the requester is authorized to modify (object-level access control).
• Enforce least privilege for vendor roles and log all password-change events with actor and target identity for auditing.
• Enable multi-factor authentication for customer accounts to blunt the impact of credential changes and account takeover.
• Continuously monitor plugin versions and subscribe to Wordfence/NVD/Patchstack advisories for Dokan and WooCommerce ecosystem components.

References

1. NVD — CVE-2026-89280: https://nvd.nist.gov/vuln/detail/CVE-2026-89280
2. CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
3. MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
4. Dokan plugin on the WordPress.org repository (version/advisory tracking): https://wordpress.org/plugins/dokan-lite/
5. CISA Known Exploited Vulnerabilities Catalog (confirm current status; not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note: No threat actor campaigns or exploit-in-the-wild evidence have been observed for CVE-2026-89280. The CVE is not listed in CISA KEV, and no public PoC, Nuclei template, or exploit code exists at the time of writing.