Privilege escalation in Wedevs Dokan Pro
CVE-2025-5931
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5. This is due to the plugin not properly validating a user's identity prior to updating their password during a staff password reset. This makes it possible for authenticated attackers, with vendor-level access and above, to elevate their privilege to the level of a staff member and then change arbitrary user passwords, including those of administrators in order to gain access to their accounts. By default, the plugin allows customers to become vendors.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (35.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 35th percentile — 35.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Wedevs Dokan Pro — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-5931?
- CVE-2025-5931 is a high-severity vulnerability in Wedevs Dokan Pro, classified under Improper Privilege Management. CVSS score: 8.8/10. Published 2025-08-26.
- How severe is CVE-2025-5931?
- High severity. CVSS v3 base score is 8.8 out of 10.