Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 23:39:14 +0000 CVE-2026-16574 — Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint https://cve.radiocsirt.org/vuln/cve-2026-16574 <p><strong>Affected:</strong> Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution</p> <p>The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor&#39;s paid downloadable files.</p> <p><strong>Affected:</strong> Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution</p> <p>The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor&#39;s paid downloadable files.</p> https://cve.radiocsirt.org/vuln/cve-2026-16574