Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-89280 · Microsoft / collected KEV context

cve-program · CVE-2026-89280

• https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa56b6b-508f-44d8-a81c-2b84cebd245b?source=cve
• https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L227
• https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L60
• https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L99
• https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L352
• https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/Order/functions.php#L858
• https://github.com/getdokan/dokan/pull/3433/changes
• https://plugins.trac.wordpress.org/changeset/3734440/dokan-lite/trunk/includes/REST/CustomersController.php

No related operational record is retained in the current change model.