CVE-2026-16574

CVE-2026-16574 is an IDOR in the Dokan multi-vendor marketplace plugin for WordPress/WooCommerce. Authenticated vendors can generate download URLs for products they do not own, allowing them to grant their customers free access to any digital product in the marketplace. The vulnerability lives in REST endpoints that correctly verify the requester is a logged-in vendor but skip the ownership check — whether the product being accessed actually belongs to that vendor. This is not a typical file-access IDOR. The marketplace context fundamentally changes the risk profile. Every authenticated vendor is an auto-requalified attacker — exploitation requires no stolen credentials, no privilege escalation, and no zero-day chain. The only barrier is willingness. A vendor who exploits this against a competitor selling digital goods can funnel that competitor's entire paid catalog to their own customer base, collapsing the competitor's pricing power not just for one product but for their entire catalog in that market segment. This is economic sabotage, not curiosity-driven probing. The CVSS 5.4 score reflects the technical mechanics — unauthorized file access — but deliberately excludes the business consequence. A single exploitation event can neutralize an entire product line's revenue within days. The marketplace operator bears contractual and reputational risk when the trust model between vendors is demonstrably broken. Why this keeps happening: WooCommerce was built for single-tenancy. Dokan layered multi-vendor ownership on top without idiomatic framework support. The missing authorization check — does this product belong to this vendor? — has no obvious helper function in WooCommerce development. The code that grants download access was likely written early in Dokan's lifecycle when vendor counts were small and digital goods weren't the primary use case. It entered the codebase, worked 'well enough,' and was never re-examined as the platform scaled to serve digital goods vendors at risk from commercial rivals. Check your exposure: Identify your Dokan version. Versions 5.0.10 and earlier are confirmed vulnerable. Review your vendor download logs for cross-vendor access patterns — look for vendors downloading products from other vendors at scale. If you run a digital goods marketplace, treat this as a platform integrity crisis, not a routine patch. The authorization boundary isn't just missing a check; it was never designed for the marketplace it now operates in.

Reviewed through automated stages and approved by a human before publication.