CVE-2026-107694 Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator...

CVE-2026-107694

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions before 5.2.0 is vulnerable to a cross-vendor information disclosure. The plugin fails to verify that the vendor requesting a commission calculation is the owner of the account for which the calculation is...

PT-2026-110018

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator...

CVE-2026-107694: Exposure of Sensitive Information to an Unauthorized Actor

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator...

KEY INVARIANT RELATED TO THE FIXED_FEE AMOUNT CAN BE BROKEN

Lines of code Vulnerability details Impact The EvolvingProteus.applyFeeByRounding function is used to charge fees by rounding values in directions that are beneficial to the pool. Within this function there is a if condition which verifies that the calculated final amount is not less than the...