CVE-2026-16564

A vulnerability exists in the Dokan plugin for WooCommerce marketplaces prior to version 5.0.9, where an attacker can exploit a REST endpoint that handles bulk order-status updates without properly checking ownership of those orders. As a result, any user with a vendor account on the marketplace can manipulate the status of all orders, including those belonging to other vendors and customers. This issue affects marketplaces running versions of Dokan prior to 5.0.9.

Based on public CVE data (MITRE/NVD).