CVE-2025-12809
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST API endpoint in all versions up to and including 4.1.3. Unauthenticated attackers can enumerate users and retrieve their email addresses and other information such as usernames, display names, user roles, and registration dates by providing a user ID.
Risk Assessment
Attackers can obtain users' personal data, violating privacy and potentially enabling phishing attacks.
Recommendation
Update the Dokan Pro plugin to a patched version. Restrict access to the REST API and monitor requests to this endpoint.
Other vulnerabilities in Dokan Pro
See all- CVE-2026-65495High
The Dokan Pro plugin versions up to 5.0.3 contain an unauthenticated Broken Access Control vulnerability. An attacker can gain unauthorized access to functions or data.
- CVE-2026-65494High
The Dokan Pro plugin versions up to 5.0.2 contain an SQL Injection vulnerability exploitable by a subscriber. An attacker with subscriber privileges can manipulate database queries.
- CVE-2026-65493High
The Dokan Pro plugin version 5.0.2 and earlier allows a subscriber-level PHP object injection. An attacker with subscriber role can submit malicious data that gets deserialized, leading to remote code execution.
- CVE-2026-65492High
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the weDevs Dokan Pro plugin allows Reflected XSS. This issue affects Dokan Pro from n/a before 5.0.7.
- CVE-2026-12224High
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via the update_capabilities REST Endpoint in all versions up to and including 5.0.4. The lack of allowlist validation allows authenticated attackers with Vendor-level access or higher, when the Vendor Staff module is enabled, to grant arbitrary WordPress capabilities, including administrator, to vendor_staff accounts, leading to full site takeover.
- CVE-2026-12077High
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'latitude' and 'longitude' parameters in all versions up to and including 5.0.4 due to insufficient escaping and lack of proper query preparation.
- CVE-2025-39497Medium
The Dokan Pro WordPress plugin has a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This affects all versions up to 3.14.5.
Original NVD description (English source)
The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST API endpoint in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to enumerate users and retrieve their email addresses via the REST API by providing a user ID, along with other information such as usernames, display names, user roles, and registration dates.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS