CVE-2026-56033: WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability

Synopsis

An unauthenticated privilege escalation vulnerability affects the Dokan Pro WordPress plugin at version 5.0.4 and below. The flaw is reachable over the network and requires no credentials, meaning any external attacker with HTTP access to the WordPress site can exploit it. Successful exploitation allows the attacker to escalate their privileges within the WordPress application, enabling full confidentiality loss, data tampering, and potential service disruption. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin is exposed over the network; an attacker must be able to send HTTP requests to the target WordPress site to exploit this vulnerability.

• AuthenticationNot required

  No credentials of any kind are needed; the exploit path is fully unauthenticated.

• Victim interactionNot required

  No action from a logged-in user or administrator is required to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• A successful attacker escalates their WordPress role to an elevated or administrative level without any prior account access.
• With elevated privileges, the attacker can read all stored site data including user records, order history, vendor details, and any stored credentials or tokens.
• The attacker can modify or delete persisted database rows, including product listings, user roles, plugin settings, and site content.
• The attacker can disable plugins, inject malicious code into theme files, or disrupt site availability entirely.