Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 10:47:45 +0000 CVE-2026-16576 — Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API https://vulnerability.circl.lu/vuln/cve-2026-16576 <p><strong>Affected:</strong> Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution</p> <p>The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.</p> <p><strong>Affected:</strong> Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution</p> <p>The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.</p> https://vulnerability.circl.lu/vuln/cve-2026-16576