CVE-2025-53425 HIGH

CVE-2025-53425: WordPress Dokan plugin <= 4.1.3 - Privilege Escalation vulnerability

Vendor Dokan, Inc.
Product Dokan
Weakness CWE-266
Published October 22, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Incorrect Privilege Assignment vulnerability in Dokan, Inc. Dokan dokan-lite allows Privilege Escalation.This issue affects Dokan: from n/a through <= 4.1.3.

Explanation of Vulnerability in Simple Terms

02Summary

Dokan versions up to 4.1.3 contain an improper access control vulnerability affecting high-privilege users. An authenticated administrator or vendor with elevated permissions can read, modify, or delete sensitive data and functionality without proper authorization checks. The vulnerability requires high-level account access but does not require user interaction. Sites running affected versions should update immediately.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete data and functionality on the site if they have high-level admin or vendor account access.

Potential impact on your site

04Site Impact

Compromised admin or vendor accounts can cause data loss, unauthorized changes, or service disruption without additional verification.

Conditions required to exploit

05Prerequisites

Attacker must have high-privilege account credentials (administrator or vendor role) on the site.

Key dates

06Disclosure timeline

October 22, 2025 CVE published
April 28, 2026 Record updated