CVE-2026-10023: Dokan WooCommerce Plugin Order Tampering Vulnerability

Technical summary

CVE-2026-10023 is an Insecure Direct Object Reference (IDOR) vulnerability in the Dokan WordPress plugin affecting versions up to 5.0.3. The vulnerability exists in six AJAX handlers: change_order_status, add_order_note, delete_order_note, add_shipping_tracking_info, grant_access_to_download, and revoke_access_to_download. Each handler accepts a user-controlled order ID parameter but fails to validate that the authenticated user has ownership of or permission to modify that order. The nonce mechanism, intended as a CSRF protection control, does not prevent exploitation because authenticated vendors can legitimately generate valid nonces by visiting their own order dashboard pages and harvest those tokens for replay against arbitrary victim order IDs. The nonce validates only that a request originates from an authenticated session, not that the requestor owns the target resource.

Business impact

A vendor compromised or acting maliciously can conduct order tampering across the entire marketplace without triggering access controls. Attack scenarios include modifying order statuses to falsely indicate fulfillment, injecting customer-facing notes that trigger buyer notifications and erode trust, deleting legitimate order notes to cover tracks, adding fraudulent shipping tracking to mislead customers, and revoking legitimate download permissions to sabotage competitors' product sales. In a marketplace with many vendors, a single compromised vendor account becomes a pivot point for widespread order data integrity violations, with direct impact on customer confidence, payment reconciliation, and operational trust.

Affected systems

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin in all versions up to and including 5.0.3 is affected. The vulnerability requires an authenticated user with vendor-level access or above; it does not affect unauthenticated users or customers without vendor roles. Any WordPress site running Dokan with multiple vendors is at risk if any vendor account is compromised or if a malicious actor gains vendor credentials.

Exploitability

Exploitability is moderate to high for affected environments. The attack requires valid vendor-level credentials, lowering the threat from completely external attackers but making insider threats and credential compromise scenarios highly relevant. Exploitation is straightforward: an attacker with vendor access navigates their own dashboard to generate a nonce, then sends a crafted AJAX request to the vulnerable handlers with a victim order ID and harvested nonce. No complex payload construction, timing windows, or race conditions are required. The vulnerability is reliably exploitable across affected versions and requires no user interaction. However, real-world impact depends on marketplace size, vendor vetting rigor, and monitoring of order modifications.

Remediation

Upgrade to a patched version released after the vulnerability disclosure. Verify against the vendor advisory for the specific patched version number. As an interim mitigation, implement strict role-based access control at the application level, monitor order modification audit logs for suspicious patterns (e.g., a vendor modifying orders they don't own), and restrict vendor permissions to only orders they have legitimately created or are assigned to fulfill. Additionally, apply WordPress security hardening practices including limiting vendor account creation, enforcing strong passwords, and reviewing active vendor sessions.

Patch guidance

Monitor the Dokan plugin repository and vendor security advisories for a patched release. Verify the patch version against the official advisory before deployment. Once available, prioritize updating to the patched version in a staging environment, test order workflows and note/tracking functionality across multiple vendor accounts, and then deploy to production. Document the pre-patch vulnerable version in your asset inventory and confirm all instances are updated.

Detection guidance

Monitor WordPress audit logs and WooCommerce order modification logs for AJAX requests to the six affected handlers originating from vendor accounts. Flag any modifications to orders where the modifying vendor is not the order owner or assigned fulfiller. Review order notes and shipping tracking entries added via AJAX for content that appears out of context or injected by unauthorized vendors. Check for rapid, bulk order status changes by a single vendor account across multiple unrelated orders. Implement alerting on nonce reuse patterns or unusually high volumes of AJAX requests from a single vendor session. Use WordPress security plugins that log AJAX activity with full parameter inspection.

Why prioritize this

Although the CVSS score is moderate (4.3), the vulnerability warrants prompt attention because it enables direct order tampering in a revenue-critical marketplace function. The barrier to exploitation is low (valid vendor credentials and the ability to harvest a nonce from one's own dashboard), making it a realistic threat in multi-vendor environments. Vendor account compromise is common via phishing, credential stuffing, and weak password practices. The business impact—order data integrity violation, customer trust erosion, and potential payment fraud—justifies prioritization ahead of many higher-scoring but less business-relevant flaws. The attack is silent and difficult to immediately detect without logging, increasing the window for undetected abuse.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects Low integrity impact and Low severity due to the requirement for prior authentication and the limited scope of resource modification (individual order records). However, the practical risk is elevated by the low barrier to exploitation, the high business sensitivity of order data, the potential for marketplace-wide abuse, and the difficulty of detection. Organizations should apply business context: a marketplace with many vendors or high transaction volume faces greater risk than a marketplace with few, trusted vendors.

Frequently asked questions