CVE-2026-10023

The Dokan plugin for WordPress, in versions up to and including 5.0.3, contains a flaw that allows attackers with vendor-level access or higher to manipulate orders they do not own. This occurs because the plugin does not verify ownership of order IDs when certain AJAX handlers are called, such as changing an order's status or adding shipping information. As a result, attackers can modify arbitrary orders, add fake notes or delete legitimate ones, and even grant or revoke access to downloads on any order in the marketplace.

Based on public CVE data (MITRE/NVD).