CVE-2026-16576
Description
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.
How to fix
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution5.0.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution | v < 5.0.14 | 5.0.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.