CVE-2026-12224: Dokan Pro Privilege Escalation via REST API

Technical summary

CVE-2026-12224 exploits inadequate input validation in the update_capabilities REST handler within Dokan Pro. The endpoint accepts capability strings directly from the request body and passes them unsanitized to WordPress's WP_User::add_cap() function. While the endpoint verifies the caller possesses the 'dokandar' capability, it performs no allowlist validation of the capabilities being granted. This allows an authenticated attacker holding Vendor-level access to escalate privileges by adding arbitrary WordPress capabilities, including 'administrator', to any vendor_staff user account. The attack chain requires the Vendor Staff module to be enabled on the site.

Business impact

Successful exploitation results in complete site takeover by an attacker with Vendor access. An adversary can grant themselves or accomplices full administrative privileges, enabling them to modify site content, install malicious plugins, extract sensitive data, redirect traffic, or dismantle the site entirely. For multi-vendor marketplaces relying on Dokan Pro, this represents a critical supply-chain-like risk where a compromised vendor account becomes a pivot point for site-wide compromise. Affected organizations face potential data breaches, business interruption, and reputational harm.

Affected systems

Dokan Pro WordPress plugin versions up to and including 5.0.4 are vulnerable. The vulnerability is only exploitable when the Vendor Staff module is enabled. Sites running older versions or without the Vendor Staff module active face no direct risk from this flaw, though updating is still recommended as a security best practice. The attack requires an authenticated user account with at least Vendor-level permissions.

Exploitability

Exploitation requires network access and an authenticated Vendor-level account on the target site. No special user interaction or unusual system configuration is needed beyond having the Vendor Staff module active. The attack is straightforward: an authenticated attacker sends a crafted REST API request to the update_capabilities endpoint specifying the 'administrator' capability for a vendor_staff user. The low complexity, low privileges barrier to entry, and high impact classify this as a practically exploitable vulnerability for any site where vendor accounts have been provisioned.

Remediation

Update Dokan Pro to the patched version addressing CVE-2026-12224 (verify exact version against the vendor advisory, as patch versions must be confirmed through official Dokan channels). After patching, perform a security audit of user account capabilities, particularly vendor_staff accounts, to identify and remediate any unauthorized privilege grants. Temporarily restrict Vendor-level user access or disable the Vendor Staff module if immediate patching is not possible and the site cannot be monitored closely.

Patch guidance

Check the official Dokan Pro release notes and security advisories for the exact patched version number. Apply updates through the WordPress plugin management interface or via direct download from the official Dokan source. Test the patch in a staging environment first to ensure compatibility with your site's configuration and other active plugins. After updating, confirm the update_capabilities endpoint is no longer accepting arbitrary capability strings by reviewing the updated code logic or performing a controlled test in a sandboxed environment.

Detection guidance

Monitor REST API logs and access to the /wp-json/dokan/v1/update_capabilities endpoint (or similar versioned endpoints) for requests originating from Vendor-level accounts. Look for POST/PUT requests with capability strings in the request body that include high-privilege capabilities like 'administrator', 'manage_options', or other sensitive roles. Alert on any successful grant of capabilities to vendor_staff accounts outside of normal vendor onboarding workflows. Query WordPress user metadata for vendor_staff accounts that unexpectedly hold administrative capabilities post-compromise.

Why prioritize this

This vulnerability merits immediate attention due to its CVSS 8.8 HIGH severity score, full authentication bypass via privilege escalation, and direct path to complete site compromise. The attack requires only Vendor-level access—a role commonly provisioned in multi-vendor marketplaces—and the Vendor Staff module is a standard feature. Unlike vulnerabilities requiring user interaction or rare configurations, this flaw is immediately actionable by any authenticated vendor. For Dokan Pro users, patching should take priority in the current security cycle.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: network-based attack vector, low attack complexity, low privilege requirements (authenticated Vendor), no user interaction, and high impact across confidentiality, integrity, and availability. While authentication is required, the privilege level is minimal (Vendor rather than Administrator), and the attack directly enables full administrative control. The score accurately captures the severity: a low-barrier privilege escalation leading to complete system compromise.

Frequently asked questions