CVE-2020-36748 Dokan <= 3.0.8 - Cross-Site Request Forgery Bypass

What is CVE-2020-36748?

CVE-2020-36748 is a medium-severity vulnerability in dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy, published on 1 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. This is due to missing or incorrect nonce validation on the handle_order_export() function. This makes it possible for unauthenticated attackers to trigger an order export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Weakness: CWE-352

Which versions are affected by CVE-2020-36748?

It affects 1 product.

Products include Dokan Dokan.

How do I fix CVE-2020-36748?

No fix has been published for CVE-2020-36748 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-36748 being exploited?

There is no known exploitation of CVE-2020-36748 in the wild and no public exploit code.

Other vulnerabilities in dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy

• CVE-2024-3922 Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection Critical 10.0
• CVE-2022-3915 Dokan < 3.7.6 - Unauthenticated SQLi Critical 9.8
• CVE-2023-26525 WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection High 7.1
• CVE-2022-3194 Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting Medium 5.4
• CVE-2023-34382 WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection Medium 4.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wxjf-25cc-8vg7.