CVE-2026-12224 Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint
Authenticated vendors can escalate privileges to administrator via the update_capabilities REST endpoint if the Vendor Staff module is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12224?
CVE-2026-12224 is a high-severity vulnerability in wedevs Dokan Pro, published on 1 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the `update_capabilities()` REST handler accepting arbitrary capability strings from the request body and passing them directly to WP_User::add_cap() with no allowlist validation, only verifying that the caller holds the dokandar capability. This makes it possible for authenticated attackers with a self-provisioned Vendor-level access and above, on sites with the Vendor Staff module enabled, to grant arbitrary WordPress capabilities, including administrator, to any vendor_staff account, leading to a full site takeover.
Weakness: CWE-269
Which versions are affected by CVE-2026-12224?
How do I fix CVE-2026-12224?
No fix has been published for CVE-2026-12224 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-12224 being exploited?
There is no known exploitation of CVE-2026-12224 in the wild and no public exploit code.
Sources
Also known as GHSA-9cv2-mw8g-x6gp.