Access violation vulnerability in Dokan Pro 4.0.5

The Dokan Pro plugin for WordPress has a security issue that can potentially allow unauthorized access to user accounts. This vulnerability affects all versions up to 4.0.5. The problem lies in the plugin’s lack of proper verification of a user’s identity when updating their password during a staff password reset. This means that attackers with vendor-level access or higher can exploit this vulnerability to gain the same privileges as a staff member and change user passwords, including those of administrators. This could potentially give them access to sensitive accounts. By default, the plugin allows customers to become vendors.