{"affected":[{"defaultStatus":"unaffected","product":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.3.3","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-107773","cwes":["CWE-863"],"description":"The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/7ef1f47f-60d2-41f0-afca-584752503fae/"}],"kev":null,"metrics":[],"modifiedAt":1793858429025,"publishedAt":1793858429025,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/7ef1f47f-60d2-41f0-afca-584752503fae/"}],"remediation":[],"revision":"fc1a4c79be0912bc17a131b7a038787f654aa0c8f150cc002a887ac53b95a81e","sources":[{"modifiedAt":1793858429025,"name":"CNA: WPScan","retrievedAt":1793858908436,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107773"}],"ssvc":null,"status":"published","title":"Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint","updatedAt":1793858908436}