CVE-2026-3504

🗓️ 02 May 2026 13:26:09Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 11 Views🌐 WEB

Unauthenticated users can reveal reviewer emails, usernames, and IDs via reviews in Dokan 4.3.1.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-3504	2 May 202613:26	–	attackerkb
Circl	CVE-2026-3504	6 May 202607:33	–	circl
CNNVD	WordPress plugin Dokan: AI Powered WooCommerce Multivendor Marketplace Solution 信息泄露漏洞	2 May 202600:00	–	cnnvd
Cvelist	CVE-2026-3504 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint	2 May 202613:26	–	cvelist
EUVD	EUVD-2026-26790	2 May 202613:26	–	euvd
NVD	CVE-2026-3504	2 May 202614:16	–	nvd
Patchstack	WordPress Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint vulnerability	1 May 202600:00	–	patchstack
Positive Technologies	PT-2026-36618	2 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-3504	4 May 202620:21	–	redhatcve
Vulnrichment	CVE-2026-3504 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint	2 May 202613:26	–	vulnrichment

Vulners

Node

dokaninc dokan:_ai_powered_woocommerce_multivendor_marketplace_solution_build_your_own_amazon,_ebay,_etsyRange≤4.3.1wordpress

[
  {
    "vendor": "dokaninc",
    "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.3.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreController.php
plugins	www.plugins.trac.wordpress.org/changeset/3481799/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/02b0d7d7-8a10-48de-b1e1-7e1f1fda6ffe
plugins	www.plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreController.php
plugins	www.plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreController.php

Parameter	Position	Path	Description	CWE
id	path	/dokan/v1/stores/{id}/reviews	Sensitive information exposure: API response includes reviewer emails, usernames, and user IDs for reviews on a store, enabling unauthenticated attackers to extract customer data.	CWE-200

17 Jun 2026 10:43Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.3

EPSS0.0026

SSVC

CWE-200