---
id: CVE-2026-107774
title: Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form
summary: >-
  The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress
  plugin before 5.3.3 does not use a trusted site-owned sender address when
  relaying its store contact form, instead placing the unauthenticated
  submitter's supp…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-290
product: 'Dokan: AI Powered WooCommerce Multivendor Marketplace Solution'
affected:
  - dokan_ai_powered_woocommerce_multivendor_marketplace_solution < 5.3.3
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T11:54:08.184548Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:07:30.830Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107774'
references:
  - url: 'https://wpscan.com/vulnerability/1d1d7ba1-9c69-47b2-beb4-ed02066cb02b/'
tags:
  - cve.org
epss: 0.00137
epssPercentile: 0.03115
ingestedAt: '2026-11-05T21:36:00.787Z'
---

## Overview

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.

## Affected

- `dokan_ai_powered_woocommerce_multivendor_marketplace_solution < 5.3.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.