CVE-2026-107694CWE-200information-disclosure

CVE-2026-107694

Low · published October 11, 2026

CVSS v3.1

2.7

EPSS

Percentile

13.0

In the wild

Unconfirmed

What it is

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.

The record

Technical detail

CVSS v3.1: 2.7 · LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00230 · 13.0th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2026-10-11T11:17Z

References (1)

https://wpscan.com/vulnerability/ddce69ff-5325-432c-9f3a-66ec9a19bcb4/ · [email protected]

EPSS history

Timeline

12 OCT 03:26Z
EPSS moved — → 0%
epss
11 OCT 06:00Z
Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint
cvelistv5
11 OCT 06:00Z
Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint
cvelistv5