CVE-2026-3504 — The Dokan: AI Powered WooCommerce Multivendor Marketplace

title: CVE-2026-3504 - Dokan WooCommerce Unauthenticated API Access to User Data
id: scw-2026-05-02-ai-1
status: experimental
level: high
description: |
  Detects unauthenticated GET requests to the Dokan WooCommerce REST API endpoint '/dokan/v1/stores/{id}/reviews'. This specific endpoint is vulnerable in versions up to 4.3.1, allowing attackers to retrieve sensitive customer information like email addresses, usernames, and user IDs without authentication. This rule targets the exact path and method used in the exploit.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-3504/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-method:
          - 'GET'
      uri|contains:
          - '/wp-json/dokan/v1/stores/'
      uri|endswith:
          - '/reviews'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse