CVE-2026-107775Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.

2.7 LOWEPSS 0.16%Not in KEVNVD: Deferred

Last updated: 2026-11-06 13:17 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
2.7	LOW	3.1CISA-ADP	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Details

CVE ID: CVE-2026-107775
Status: Deferred
Assigner (CNA): WPScan
Published: Nov 5, 2026
Last modified: 2026-11-06 13:17 UTC
Weaknesses: CWE-863

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:47 UTC.