WordPress Dokan plugin < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API vulnerability

Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Dokan versions 5.0.9...

CVE-2026-16565

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor'...

CVE-2026-16565: Authorization Bypass Through User-Controlled Key

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor'...

CVE-2019-8229

In Magento prior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit product attributes can execute arbitrary code through crafted layout updates...