What is GHSA-hmc3-7cfv-4mfr?

GHSA-hmc3-7cfv-4mfr is a security advisory published by GitHub Security Advisories with Medium severity. The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0...

Which CVE IDs does GHSA-hmc3-7cfv-4mfr cover?

GHSA-hmc3-7cfv-4mfr covers the following CVE IDs: CVE-2026-16575. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hmc3-7cfv-4mfr?

GHSA-hmc3-7cfv-4mfr has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-hmc3-7cfv-4mfrMediumCVSS 5.3

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0...

Vendor

GitHub Security Advisories

Published

August 21, 2026

Last Modified

August 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-16575 →

📋 Description

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16575
https://wpscan.com/vulnerability/44ab8be6-c0d8-459b-9597-79cb28bac09b
https://github.com/advisories/GHSA-hmc3-7cfv-4mfr