{"cve":"CVE-2026-107773","enrichment":{"created":"2026-11-05T07:30:14.787211+00:00","updated":"2026-11-05T07:30:14.787216+00:00","vendors":[],"weaknesses":["CWE-284"]},"mitre":{"cpes":[],"created":"2026-11-05T06:00:29.025000+00:00","description":"The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/107xxx/CVE-2026-107773.json","references":["https://wpscan.com/vulnerability/7ef1f47f-60d2-41f0-afca-584752503fae/"],"title":"Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint","updated":"2026-11-05T06:00:29.025000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-11-05T06:17:06.990000+00:00","description":"The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-107773.json","references":["https://wpscan.com/vulnerability/7ef1f47f-60d2-41f0-afca-584752503fae/"],"title":null,"updated":"2026-11-05T06:17:06.990000+00:00","vendors":[],"weaknesses":[]},"opencve":{"changes":[{"created":"2026-11-05T06:15:00+00:00","data":[{"details":{"new":"The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.","old":null},"type":"description"},{"details":{"new":"Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint","old":null},"type":"title"},{"details":{"added":["https://wpscan.com/vulnerability/7ef1f47f-60d2-41f0-afca-584752503fae/"],"removed":[]},"type":"references"}],"id":"68f4337a-acad-47f1-905b-1121ae0ab627"},{"created":"2026-11-05T07:45:00+00:00","data":[{"details":{"added":["CWE-284"],"removed":[]},"type":"weaknesses"}],"id":"a41dadc8-90c3-464b-ad8c-5983e809deaf"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T06:00:29.025000+00:00","provider":"mitre"},"description":{"data":"The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://wpscan.com/vulnerability/7ef1f47f-60d2-41f0-afca-584752503fae/"],"providers":["mitre","nvd"]},"title":{"data":"Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint","provider":"mitre"},"updated":{"data":"2026-11-05T07:30:14.787216+00:00","provider":"enrichment"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":["CWE-284"],"providers":["enrichment"]}}}