PT-2026-36618 · WordPress · Dokan

Rafshanzani Suhada · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-3504

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dokan: AI Powered WooCommerce Multivendor Marketplace Solution versions prior to 4.3.2

Description Sensitive information exposure occurs via the '/dokan/v1/stores/{id}/reviews' REST API endpoint. The prepare reviews for response() method includes reviewer email addresses, usernames, and user IDs in the API response. This allows unauthenticated attackers to extract the email addresses, usernames, and user IDs of all customers who have left reviews on any vendor's store. This issue requires the Pro version of the plugin to be installed and activated, with store reviews enabled.

Recommendations Update to a version later than 4.3.1. As a temporary workaround, disable store reviews or restrict access to the '/dokan/v1/stores/{id}/reviews' endpoint to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-3504

Affected Products

Dokan

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-3504 · Security Note
• https://t.me/cveNotify/161876 · Telegram Post
• https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreController.php#L854 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/02b0d7d7-8a10-48de-b1e1-7e1f1fda6ffe?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3481799 · Note
• https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreController.php#L835 · Note
• https://t.me/CVEtracker/52533 · Telegram Post
• https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreController.php#L125 · Note