CVE-2026-16576: Dokan WooCommerce Plugin Privilege Escalation to RCE

Executive Summary

CVE-2026-16576 is a privilege escalation vulnerability in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution, one of the most widely deployed multi-vendor marketplace plugins for WooCommerce. The flaw stems from an improper capability check on admin-level REST API endpoints, allowing authenticated users with Shop Manager privileges to install and activate arbitrary WordPress plugins — effectively enabling Remote Code Execution on the WordPress host.

The vulnerability is patched in Dokan 5.0.14. All prior versions are affected.

Vulnerability Overview

Root Cause

The plugin registers several admin REST API routes intended for site administrator use only. However, the middleware guarding these routes checks only for the shop_manager capability level rather than the higher administrator capability. In multi-vendor marketplace deployments, Shop Manager accounts are commonly granted to third-party sellers who are not trusted administrators.

This incorrect capability check (CWE-285: Improper Authorization) means any Shop Manager can call admin-only REST endpoints without restriction.

Attack Chain

1. Attacker registers or compromises a Shop Manager account
   (common in multi-vendor marketplaces with open vendor registration)
2. Sends crafted REST API request to the /dokan/v1/admin/* endpoint
3. Plugin skips administrator capability check — authorizes Shop Manager
4. Attacker POSTs a request to install a malicious plugin from a controlled URL
5. WordPress downloads and activates the malicious plugin
6. Arbitrary PHP code executes with web server privileges
7. Full WordPress site compromise achieved

Severity Assessment

While the vulnerability requires an authenticated account, the multi-vendor marketplace model means Shop Manager credentials are routinely issued to external, untrusted parties — effectively reducing the real-world exploitation barrier considerably.

Technical Details

Affected Endpoint

The improper capability check applies to admin REST routes registered under the /dokan/v1/admin/ namespace. Plugin management endpoints within this namespace were gatekept with manage_woocommerce (Shop Manager) instead of the required manage_options (Administrator) capability.

Affected Versions

Why Plugin Installation Equals Code Execution

WordPress plugins are arbitrary PHP code. When WordPress activates a plugin, that code runs in the context of the web server process. A malicious plugin can:

• Open a reverse shell connection to an attacker-controlled server
• Create new administrator accounts
• Modify the database, including injecting malicious content
• Steal all stored credentials, API keys, and customer data
• Leverage the server for lateral movement to adjacent systems

This is equivalent to unauthenticated RCE in any environment where Shop Manager accounts are issued to untrusted third parties.

Identifying Affected Installations

Detection Approach

# Check currently installed Dokan version via WP-CLI
wp plugin list --name=dokan-lite --fields=name,version,status
 
# Check REST API capability registrations (advanced — requires file access)
grep -r "shop_manager\|manage_woocommerce" \
  wp-content/plugins/dokan-lite/includes/REST/ --include="*.php"
 
# Review recent plugin installs (potential post-exploitation indicator)
wp plugin list --fields=name,version,status,update

Risk Indicators

Remediation

Immediate Actions

1. Update Dokan to 5.0.14 or later — the fix correctly gates admin REST routes behind manage_options.

# Update via WP-CLI
wp plugin update dokan-lite

2. Review recently installed plugins for unexpected or malicious entries.

3. Audit Shop Manager accounts — revoke any suspicious or unrecognized accounts.

4. Review REST API logs for unusual calls to /dokan/v1/admin/ endpoints, particularly from non-administrator accounts.

Compensating Controls (If Immediate Update Is Not Possible)

• Restrict the WordPress REST API at the web server layer to trusted IP ranges
• Temporarily disable new vendor registration
• Monitor all plugin install/activation events via a security plugin or WAF

Detection Rules

SIEM / WAF Query

# Detect unusual REST calls to Dokan admin endpoints from low-priv accounts
uri_path CONTAINS "/dokan/v1/admin/" AND user_role IN ("shop_manager", "vendor")

# Detect new plugin activations
event.action = "plugin_activation" AND actor.role != "administrator"

WordPress Audit Log (Wordfence / Sucuri)

Monitor for:

• Plugin installation events from non-administrator accounts
• REST API calls to /wp-json/dokan/v1/admin/* by vendor or shop manager users
• POST requests to /wp-json/wp/v2/plugins from non-admin sessions

References

• NVD — CVE-2026-16576
• Dokan Changelog — v5.0.14
• WordPress Plugin Capability Checks Best Practices

Related Reading

• BeyondTrust Remote Support Pre-Authentication RCE
• Apache Struts Critical RCE via OGNL Injection Returns