CVE-2026-16577 Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...

CVE-2026-19711

The Premium Packages – Sell Digital Products Securely WordPress plugin (versions before 7.0.7 ) contains a vulnerability where it fails to validate withdrawal requests against a user's actual earned balance. This flaw allows any authenticated user , including a subscriber with no sales history, t...

PT-2026-71050

Name of the Vulnerable Software and Affected Versions Wallet System for WooCommerce versions prior to 2.7.10 Description Authenticated users with Custom-level access and above can bypass payments during checkout. The issue occurs because the plugin fails to validate the user-supplied wallet amoun...

_payoutEth() gas computation can make call revert even if balance is sufficient

Lines of code Vulnerability details Payout recipients can call getEthPayout to transfer the ETH balance of the contract to all payout recipients. This function makes an internal call to payoutEth, which computes the gasCost, then proceeds to check balance - gasCost 10000 before sending the result...