CVE-2026-49780: WordPress Dokan plugin <= 5.0.2 - Privilege Escalation vulnerability

Synopsis

This is a privilege escalation vulnerability in the Dokan WordPress plugin, versions 5.0.2 and earlier. It is reachable over the network and requires only a low-privilege account (such as a standard customer account on a marketplace site) to exploit. Successful exploitation allows an attacker to elevate their permissions within the WordPress site, gaining the ability to read, modify, or destroy data and functionality beyond what their account should permit. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress site over the network; no local or physical access is needed.

• AuthenticationRequired

  A low-privilege account (such as a standard customer account on the Dokan marketplace) is sufficient; no admin credentials are needed.

• Victim interactionNot required

  No victim action is needed; the attacker can trigger the privilege escalation entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors.

Blast Radius

• An attacker elevates their WordPress role beyond the customer level, gaining access to administrative or vendor-level functionality.
• With elevated permissions, the attacker reads sensitive site data including order records, customer personally identifiable information, and stored payment references.
• The attacker can modify or delete product listings, orders, user records, and site configuration.
• Depending on the escalated role, the attacker may install plugins or execute server-side code, potentially leading to full site compromise.