15,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Dokan Pro WordPress Plugin
15,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Dokan Pro WordPress Plugin
Latest Reports: • WordPress Vulnerability Reports by Wordfence
Blog Post: https://www.wordfence.com/blog/2025/0...
🛡️ Get Wordfence: https://www.wordfence.com/products/pr...
🔵 Try Wordfence Central - https://www.wordfence.com/help/central/
⭐ Wordfence is Trusted by over 5 Million Websites
On June 5th, 2025, we received a submission for a Privilege Escalation vulnerability in Dokan Pro, a WordPress plugin with more than 15,000 sales. This vulnerability makes it possible for an authenticated attacker, with vendor-level permission, to change the password of any user, including an administrator, which allows them to take over the account and the website.
Props to Foxyyy who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $966.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on June 10, 2025. Sites using the free version of Wordfence received the same protection 30 days later on July 10, 2025.
We contacted the Dokan team on June 9, 2025, and they registered on our Wordfence Vulnerability Management Portal for WordPress vendors on June 12, 2025. After receiving the full disclosure details instantly through the portal, the developer released the patch on August 6, 2025.
We urge users to update their sites with the latest patched version of Dokan Pro, version 4.0.6 at the time of this writing, as soon as possible.
Read more in the full blog post: https://www.wordfence.com/blog/2025/0...
Stay informed and secure: read the full details and expert analysis on the Wordfence blog: https://www.wordfence.com/blog/
🔗 Get Wordfence today: https://www.wordfence.com/
🔐 Learn more about WordPress security: https://www.wordfence.com/learn/
🎥 Watch the full WordPress Security Essentials series here:
• WordPress Security Essentials by Wordfence...
Wordfence is designed for defense in depth by giving you a layered approach to security with our range of features.
#WordPress #WordPressSecurity #Cybersecurity #WebsiteProtection #Wordfence #OnlineSecurity #wordpress
===== Protect Your Site With Wordfence =====
✅ Get Wordfence Free: https://www.wordfence.com/products/wo...
✅ Get Wordfence Premium: https://www.wordfence.com/products/wo...
✅ Get Wordfence Care: https://www.wordfence.com/products/wo...
✅ Get Wordfence Response: https://www.wordfence.com/products/wo...
📝 Wordfence Audit Log:
All premium Wordfence plans include access to the Wordfence Audit Log — capturing, securely storing, and protecting important security events for forensic analysis.
🔵 Connect Your Sites To Wordfence Central:
https://www.wordfence.com/help/central/
Manage all your WordPress sites from one centralized dashboard.
💸 Want to earn money promoting Wordfence? Join the Wordfence Affiliate Program:
👉 Learn more: • How To Earn Money With The Wordfence Affil...
👉 Join: https://www.wordfence.com/affiliate
🐞 Earn money via our Bug Bounty Program:
Find vulnerabilities in WordPress plugins and themes and get rewarded!
👉 Join: https://www.wordfence.com/refer/youtube