Dokan Pro WordPress Plugin Privilege Escalation via REST API

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the `update_capabilities()` REST handler accepting arbitrary capability strings from the request body and passing them directly to WP_User::add_cap() with no allowlist validation, only verifying that the caller holds the dokandar capability. This makes it possible for authenticated attackers with a self-provisioned Vendor-level access and above, on sites with the Vendor Staff module enabled, to grant arbitrary WordPress capabilities, including administrator, to any vendor_staff account, leading to a full site takeover.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Dokan Pro WordPress plugin contains a critical privilege escalation vulnerability in its REST API `update_capabilities` endpoint that affects all versions through 5.0.4. The vulnerability allows authenticated attackers with vendor-level privileges to arbitrarily assign WordPress capabilities to their user account by sending unvalidated capability strings directly to the WP_User::add_cap() function. While the endpoint checks that callers possess the 'dokandar' capability, it fails to implement an allowlist of permitted capabilities, enabling attackers to grant themselves administrative permissions and escalate from a low-privilege vendor account to full site administrator access. This impacts any WordPress installation using Dokan Pro, particularly multi-vendor marketplaces where vendor accounts are commonly provisioned for third parties.

Casky's 754 security skills mapped to MITRE ATT&CK would detect this attack pattern through TA0004 (Privilege Escalation) detection frameworks, specifically identifying the characteristic signatures of capability-based permission bypass attempts. Practitioners using Casky would see findings highlighting: (1) REST API requests to `/update_capabilities` endpoints with suspicious capability parameters (e.g., 'manage_options', 'edit_users'); (2) authenticated sessions escalating from vendor to administrator role without administrative user action; (3) abnormal capability grants following REST API calls from low-privilege accounts; and (4) divergence between user role assignments and actual capabilities granted. Claude's extended reasoning would correlate these signals across request logs, user audit trails, and capability change events to distinguish legitimate administrative actions from exploitation attempts, providing practitioners with high-confidence alerts for immediate containment.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12224.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

analyzing-cloud-storage-access-patterns

cloud security · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-12224

Casky has 224 skills that investigate the attack patterns behind CVE-2026-12224. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn