CVE-2026-12224— Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint

Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the `update_capabilities()` REST handler accepting arbitrary capability strings from the request body and passing them directly to WP_User::add_cap() with no allowlist validation, only verifying that the caller holds the dokandar capability. This makes it possible for authenticated attackers with a self-provisioned Vendor-level access and above, on sites with the Vendor Staff module enabled, to grant arbitrary WordPress capabilities, including administrator, to any vendor_staff account, leading to a full site takeover.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

特权管理不恰当

Dokan Pro 权限许可和访问控制问题漏洞

Dokan Dokan Pro是Dokan公司的一款面向电商的店铺管理系统。 Dokan Pro 5.0.4及之前版本存在权限许可和访问控制问题漏洞，该漏洞源于update_capabilities() REST处理程序未进行白名单验证，可能导致已认证攻击者提升权限至管理员，从而完全接管站点。

N/A

N/A