CVE-2025-14977

🗓️ 20 Jan 2026 04:35:45Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 15 Views🌐 WEB

CVE-2025-14977: Dokan plugin allows authenticated customers to access other vendors' settings and PayPal data.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2025-14977	20 Jan 202604:35	–	attackerkb
Circl	CVE-2025-14977	20 Jan 202605:24	–	circl
CNNVD	WordPress plugin Dokan: Access control error vulnerability	20 Jan 202600:00	–	cnnvd
Cvelist	CVE-2025-14977 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure	20 Jan 202604:35	–	cvelist
EUVD	EUVD-2026-3482	20 Jan 202604:35	–	euvd
NVD	CVE-2025-14977	20 Jan 202605:16	–	nvd
Patchstack	WordPress Dokan plugin <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure vulnerability	20 Jan 202606:07	–	patchstack
Positive Technologies	PT-2026-3536	20 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2025-14977	21 Jan 202606:33	–	redhatcve
Vulnrichment	CVE-2025-14977 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure	20 Jan 202604:35	–	vulnrichment

Vulners

Node

dokaninc dokan:_ai_powered_woocommerce_multivendor_marketplace_solution_build_your_own_amazon,_ebay,_etsyRange≤4.2.4wordpress

[
  {
    "vendor": "dokaninc",
    "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.2.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/4ab9d7e9-9a81-48f8-bc37-ad6de43a566f
plugins	www.plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php
plugins	www.plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php
plugins	www.plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php
plugins	www.plugins.trac.wordpress.org/changeset

Parameter	Position	Path	Description	CWE
key	path	/wp-json/dokan/v1/settings	Insecure Direct Object Reference via Dokan REST API allowing read/modify of other vendors' store settings using a user-controlled key	CWE-284

15 Apr 2026 00:35Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.18.1

EPSS0.00045

SSVC

CWE-284