What is GHSA-9qg2-vxvm-6fvv?

GHSA-9qg2-vxvm-6fvv is a security advisory published by GitHub Security Advisories with Medium severity. The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0...

Which CVE IDs does GHSA-9qg2-vxvm-6fvv cover?

GHSA-9qg2-vxvm-6fvv covers the following CVE IDs: CVE-2026-16574. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9qg2-vxvm-6fvv?

GHSA-9qg2-vxvm-6fvv has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-9qg2-vxvm-6fvvMediumCVSS 5.4

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0...

Vendor

GitHub Security Advisories

Published

August 8, 2026

Last Modified

August 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-16574 →

📋 Description

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16574
https://wpscan.com/vulnerability/b38dc6a4-a590-402f-88e1-3624a22c7348
https://github.com/advisories/GHSA-9qg2-vxvm-6fvv