---
id: CVE-2026-107773
title: >-
  Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via
  Orders REST Endpoint
summary: >-
  The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress
  plugin before 5.3.3 does not correctly verify authorization when serving a
  single order and its order notes, allowing unauthenticated attackers to read
  custome…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-863
product: 'Dokan: AI Powered WooCommerce Multivendor Marketplace Solution'
affected:
  - dokan_ai_powered_woocommerce_multivendor_marketplace_solution < 5.3.3
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T11:54:19.535222Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:07:45.883Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107773'
references:
  - url: 'https://wpscan.com/vulnerability/7ef1f47f-60d2-41f0-afca-584752503fae/'
tags:
  - cve.org
epss: 0.00137
epssPercentile: 0.03119
ingestedAt: '2026-11-05T21:36:00.789Z'
---

## Overview

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.

## Affected

- `dokan_ai_powered_woocommerce_multivendor_marketplace_solution < 5.3.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.