CVE-2026-107776Low· 2.2▾ SunlitThe Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission d…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 12.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.
Dokan < 5.3.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123788Medium· 4.3chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow
CVE-2025-2938Low· 3.1Business Logic Errors in GitLab
CVE-2026-116461Medium· 4.3Omega Solution Restro POS sale-invoice logic error
CVE-2026-106070Low· 3.7A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does …
CVE-2026-115248Medium· 5.4subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow
CVE-2026-112028Medium· 6.5light0011 cms Vote VoteController.class.php logic error