CVE-2020-36748: 
WordPress vulnerability analysis and mitigation

The Dokan plugin for WordPress (versions up to and including 3.0.8) contains a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2020-36748. The vulnerability was discovered in the handle_order_export() function due to missing or incorrect nonce validation (NVD).

The vulnerability stems from improper implementation of security controls in the handle_order_export() function. The CVSS v3.1 base score is 4.3 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction (Wordfence).

When successfully exploited, the vulnerability allows unauthenticated attackers to trigger an order export through a forged request, provided they can deceive a site administrator into performing specific actions like clicking a malicious link (NVD).

The vulnerability has been patched in versions after 3.0.8. Site administrators are advised to update their Dokan plugin to the latest version. A patch was implemented to address the nonce validation issue (WordPress Plugin).