CVE-2026-107776Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coupon

The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.

2.2 LOWEPSS 0.20%Not in KEVNVD: Deferred

Last updated: 2026-11-05 15:06 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
2.2	LOW	3.1WPScan (CNA)	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

Details

CVE ID: CVE-2026-107776
Status: Deferred
Assigner (CNA): WPScan
Published: Nov 5, 2026
Last modified: 2026-11-05 15:06 UTC

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:44 UTC.