CVE-2025-14977

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14977", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-19T15:58:09.269Z", "datePublished": "2026-01-20T04:35:45.902Z", "dateUpdated": "2026-04-08T16:50:47.498Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:47.498Z"}, "affected": [{"vendor": "dokaninc", "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.2.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.2.4 via the `/wp-json/dokan/v1/settings` REST API endpoint due to missing validation on a user-controlled key. This makes it possible for authenticated attackers, with customer-level permissions and above, to read or modify other vendors' store settings including sensitive payment information (PayPal email, bank account details, routing numbers, IBAN, SWIFT codes), phone numbers, and addresses, and change PayPal email addresses to attacker-controlled addresses, enabling financial theft when the marketplace processes payouts."}], "title": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ab9d7e9-9a81-48f8-bc37-ad6de43a566f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L131"}, {"url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L152"}, {"url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L109"}, {"url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L85"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3432750%40dokan-lite%2Ftrunk&old=3427612%40dokan-lite%2Ftrunk&sfp_email=&sfph_mail=#file7"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-284 Improper Access Control", "cweId": "CWE-284", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "timeline": [{"time": "2025-12-19T16:13:51.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-19T15:32:29.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T15:11:15.839516Z", "id": "CVE-2025-14977", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:11:26.613Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14977", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-20T15:11:15.839516Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:11:20.893Z"}}], "cna": {"title": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}}], "affected": [{"vendor": "dokaninc", "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.2.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-19T16:13:51.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-19T15:32:29.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ab9d7e9-9a81-48f8-bc37-ad6de43a566f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L131"}, {"url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L152"}, {"url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L109"}, {"url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L85"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3432750%40dokan-lite%2Ftrunk&old=3427612%40dokan-lite%2Ftrunk&sfp_email=&sfph_mail=#file7"}], "descriptions": [{"lang": "en", "value": "The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.2.4 via the `/wp-json/dokan/v1/settings` REST API endpoint due to missing validation on a user-controlled key. This makes it possible for authenticated attackers, with customer-level permissions and above, to read or modify other vendors' store settings including sensitive payment information (PayPal email, bank account details, routing numbers, IBAN, SWIFT codes), phone numbers, and addresses, and change PayPal email addresses to attacker-controlled addresses, enabling financial theft when the marketplace processes payouts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:47.498Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14977", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:50:47.498Z", "dateReserved": "2025-12-19T15:58:09.269Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-20T04:35:45.902Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy", "vendor": "dokaninc", "versions": [{"lessThanOrEqual": "4.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.2.4 via the `/wp-json/dokan/v1/settings` REST API endpoint due to missing validation on a user-controlled key. This makes it possible for authenticated attackers, with customer-level permissions and above, to read or modify other vendors' store settings including sensitive payment information (PayPal email, bank account details, routing numbers, IBAN, SWIFT codes), phone numbers, and addresses, and change PayPal email addresses to attacker-controlled addresses, enabling financial theft when the marketplace processes payouts."}, {"lang": "es", "value": "El plugin Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy para WordPress es vulnerable a Referencia Directa a Objeto Insegura en versiones hasta la 4.2.4, inclusive, a trav\u00e9s del endpoint de la API REST `/wp-json/dokan/v1/settings` debido a la falta de validaci\u00f3n en una clave controlada por el usuario. Esto hace posible que atacantes autenticados, con permisos de nivel de cliente y superiores, lean o modifiquen la configuraci\u00f3n de la tienda de otros proveedores, incluyendo informaci\u00f3n de pago sensible (correo electr\u00f3nico de PayPal, detalles de la cuenta bancaria, n\u00fameros de ruta, IBAN, c\u00f3digos SWIFT), n\u00fameros de tel\u00e9fono y direcciones, y cambien las direcciones de correo electr\u00f3nico de PayPal a direcciones controladas por el atacante, lo que permite el robo financiero cuando el marketplace procesa los pagos."}], "id": "CVE-2025-14977", "lastModified": "2026-06-17T08:36:52.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14977", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T15:11:15.839516Z", "version": "2.0.3"}}]}, "published": "2026-01-20T05:16:08.293", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L109"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L131"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L152"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L85"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3432750%40dokan-lite%2Ftrunk&old=3427612%40dokan-lite%2Ftrunk&sfp_email=&sfph_mail=#file7"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ab9d7e9-9a81-48f8-bc37-ad6de43a566f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:15:59.247758+00:00", "value": {"mitigation_remediation": ["Upgrade the Dokan plugin to the latest available version (v4.2.5 or later) where this flaw has been fixed.", "If an upgrade is not immediately possible, restrict vendor user roles to the minimum permissions required for their tasks; avoid giving customer-level rights to accounts that do not need them.", "Patch the API endpoint by adding validation to ensure that the key parameter can only reference the authenticated vendor\u2019s own store settings; if necessary for regression, temporarily block the related REST route for unauthenticated or low\u2011privilege users.", "Regularly review and rotate vendor account credentials and enforce strong password policies.", "Monitor REST API traffic for unexpected changes to PayPal or banking fields and investigate any anomalies promptly."], "summary": {"action": "Immediate Patch", "impact": "Data integrity and confidentiality breach, possible PayPal account takeover and financial theft"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy plugin for WordPress in all releases up to and including version 4.2.4. The CMS context is WordPress, and the affected component is the Dokan REST API handling vendor settings.", "description_and_impact": "This vulnerability arises from an insecure direct object reference in the Dokan plugin\u2019s REST API endpoint /wp-json/dokan/v1/settings, where a user-controlled key is not validated. An authenticated user with customer-level or higher permissions can read or modify any vendor\u2019s store settings, including payment information such as PayPal email, bank account numbers, routing numbers, IBAN, SWIFT, phone and address details. The attacker can change the PayPal email to a malicious address, enabling the marketplace to route payouts to the attacker\u2019s account. This results in both disclosure of sensitive financial data and potential diversion of payments to an unauthorized account.", "risk_and_exploitability": "The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1% suggests that widespread exploitation is currently unlikely, however the requirement for authenticated access means that attackers who compromise vendor credentials or create new accounts with sufficient permissions could exploit the flaw. The vulnerability is not listed in CISA's KEV catalog, so no public exploitation case has been reported yet. Given the potential for financial theft and broad access to sensitive information, it poses a significant risk to merchants and their customers.\n\nThe likely attack path involves an attacker gaining legitimate vendor credentials or creating a vendor account, then calling the vulnerable REST endpoint to retrieve or alter another vendor\u2019s configuration. The missing validation on the key parameter allows the attacker to specify any vendor ID, bypassing intended access controls.\n\nOverall, while exploitation probability is low at present, the high impact on money\u2011related data warrants immediate attention."}}}}, "created": "2026-01-20T08:39:53.312677+00:00", "updated": "2026-04-21T16:30:40.668837+00:00", "vendors": ["dokan", "dokan$PRODUCT$dokan", "wordpress", "wordpress$PRODUCT$wordpress"]}