Dokan Pro WordPress Plugin Missing Authorization Vulnerability Allowing Unauthenticated Data Exposure

A vulnerability exists in the Dokan Pro plugin for WordPress, in all versions through 4.1.3, due to a lack of proper capability checks on the '/dokan/v1/wholesale/register' REST API endpoint. This flaw enables unauthenticated attackers to enumerate users and access their email addresses via the REST API by supplying a user ID along with additional details such as usernames, display names, user roles, and registration dates.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive user information, including email addresses and other personal details, potentially facilitating further attacks or abuse.

Remediation

Users are advised to update the Dokan Pro plugin to version 4.2.0 or later.