CVE-2026-16564: 
WordPress vulnerability analysis and mitigation

CVE-2026-16564 is an authorization bypass (IDOR) vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin affecting all versions before 5.0.9. The flaw allows any authenticated user with a Dokan vendor account to modify the order status of any WooCommerce order on the marketplace — including orders belonging to other vendors and customers — via an unprotected bulk order-status REST endpoint. It was publicly disclosed on July 24, 2026, and assigned a CVSS score of 4.3 (Medium) (WPScan, GitHub Advisory).

The root cause is a missing ownership verification check on the orders/bulk-actions REST API endpoint, classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and categorized under OWASP Top 10 A5: Broken Access Control. An attacker with a valid Dokan vendor account can craft REST API requests targeting this endpoint, supplying arbitrary order IDs not belonging to them, and the plugin will process the status change without validating that the requesting vendor owns those orders. No special privileges beyond a standard vendor account are required, and no interaction from other users is needed (WPScan). A proof-of-concept was scheduled for public release on August 7, 2026, giving users time to patch (WPScan).

A malicious vendor can arbitrarily change the status of any WooCommerce order across the entire marketplace, including orders placed with competing vendors and direct customer orders. This can disrupt marketplace operations by falsely marking orders as completed, cancelled, or refunded, leading to financial record manipulation, customer disputes, and reputational damage to the store. While the vulnerability does not directly expose sensitive data or allow code execution, it undermines the integrity of the entire order management system (WPScan, GitHub Advisory).

1. Obtain a vendor account: Register or compromise a Dokan vendor account on the target WooCommerce multivendor marketplace running the vulnerable plugin (< 5.0.9).
2. Authenticate to the REST API: Obtain a valid authentication token or use session cookies associated with the vendor account to interact with the WooCommerce/Dokan REST API.
3. Enumerate order IDs: Use the WooCommerce REST API or marketplace browsing features to identify order IDs belonging to other vendors or customers (e.g., by observing order ID sequences or using API endpoints that leak order metadata).
4. Craft a bulk status change request: Send an authenticated HTTP POST request to the orders/bulk-actions REST endpoint, supplying arbitrary order IDs and a desired target status (e.g., completed, cancelled):

   POST /wp-json/dokan/v1/orders/bulk-actions
   Authorization: Bearer <vendor_token>
   Content-Type: application/json
   
   {"order_ids": [1001, 1002, 1003], "status": "cancelled"}

5. Confirm unauthorized modification: Verify that the targeted orders — belonging to other vendors or customers — have had their status changed, confirming successful exploitation (WPScan).

• Network: Unusual authenticated REST API POST requests to /wp-json/dokan/v1/orders/bulk-actions originating from vendor accounts, especially with order IDs outside the requesting vendor's own order set; high-frequency bulk status change requests from a single vendor account.
• Logs: WordPress/WooCommerce access logs showing repeated calls to the orders/bulk-actions endpoint by a single vendor user across a wide range of order IDs; order status change audit entries in WooCommerce order notes reflecting changes made by a vendor who does not own the affected orders.
• Application: Unexpected order status changes (e.g., mass cancellations or completions) across multiple vendors' orders within a short time window; customer or vendor complaints about orders being incorrectly marked as completed or cancelled.

Update the Dokan plugin (dokan-lite) to version 5.0.9 or later, which introduces proper order ownership verification on the orders/bulk-actions REST endpoint (WPScan). If immediate patching is not feasible, consider implementing a Web Application Firewall (WAF) rule to restrict or monitor access to the /wp-json/dokan/v1/orders/bulk-actions endpoint, or temporarily disable vendor access to bulk order actions at the server or application level. Marketplace administrators should also audit recent order status changes for anomalies that may indicate prior exploitation.

The vulnerability was discovered and reported by security researcher Shivamani Vastrala and verified by WPScan (WPScan). No significant broader media coverage or notable community commentary beyond standard vulnerability database aggregation has been observed at this time.