CVE Intelligence
Analysis AI-assisted

CVE-2026-56033: Dokan Pro Unauthenticated Privilege Escalation

CVE-2026-56033 describes an unauthenticated privilege escalation issue in Dokan Pro versions up to and including 5.0.4, mapped to CWE-266. The CNA Patchstack assigns a CVSS 3.1 base score of 9.8 (critical). The record does not list structured affected or fixed versions, and CISA KEV does not list it.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This record describes an unauthenticated privilege escalation issue in Dokan Pro, a WordPress plugin, in versions up to and including 5.0.4. The weakness is associated with CWE-266 (Incorrect Privilege Assignment). The CNA is Patchstack.

Impact

Privilege escalation without authentication means a party who can reach the affected site without logging in may be able to obtain privileges beyond those intended. The CVSS 3.1 vector in the record describes network attack, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity and availability, with a base score of 9.8.

Affected products and versions

  • Product: Dokan Pro, a WordPress plugin.
  • Stated affected range: versions up to and including 5.0.4.
  • The record does not list structured affected or fixed versions.

Exploitation status

CISA KEV does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00483 with a percentile of 0.39878.

Remediation and mitigation

  • Identify whether Dokan Pro is installed and which version is in use.
  • Check the vendor or the Patchstack entry for a release newer than 5.0.4 and apply it where available.
  • If no fix is confirmed, consider limiting access to administrative and account-management functions and monitoring for unexpected account changes until a fixed version is verified.

Detection guidance

  • Review user accounts for unexpected role or capability changes, especially newly created accounts with elevated roles.
  • Review web server and application logs at a high level for unusual activity against account-related functions of the plugin.
  • Compare installed plugin versions against the stated affected range.

Limitations of the available information

The record does not describe the technical mechanism, the affected functions, a fixed version, or the CWE name. The record shows a Deferred source status. The CVSS score comes from the CNA, and no other provider score is shown.

Frequently asked questions

What is CVE-2026-56033?

It is an unauthenticated privilege escalation issue in Dokan Pro versions up to and including 5.0.4, according to the record.

Is this CVE known to be exploited in the wild?

CISA KEV does not list it in the record, and no confirmed exploitation appears in the sources consulted.

Is a fixed version available?

The record does not identify a fixed version. Check the vendor or the Patchstack entry for an update newer than 5.0.4.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.