CVE-2026-16576

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress versions prior to 5.0.14 has a vulnerability that improperly checks user capabilities on certain admin REST API routes. This flaw allows users with WooCommerce management capabilities, such as Shop Managers, to install and activate any arbitrary version of the plugin, potentially leading to unauthorized modifications or malicious code execution. WordPress site administrators using this plugin should prioritize updating to version 5.0.14 or later to mitigate this risk.