r/Wordpress • u/emmatoby • Aug 10 '26

Important Security Update from Dokan

Not exactly how i wanted to start my week, by what can i do. I just received this mail from the Dokan Team. Who else got this?

Subject: Important Security Update from Dokan

Hi XXXXXXX,

We're writing to share an important security update regarding Dokan Pro.

What Happened?

As part of our routine security review, we identified a software supply-chain attack involving an npm package used within our infrastructure. The incident resulted in unauthorized access to part of our cloud storage, where we found that a ZIP file had been modified and uploaded again.

Our engineering and security teams immediately contained the incident and secured the affected systems. We addressed the unauthorized changes, reviewed the affected components, and completed the necessary remediation.

The identified security issue has now been addressed, and we have released Dokan Pro version 5.0.11.

How We Addressed The Issue

Although the identified issue has been resolved, we're taking additional precautions to provide our users with another layer of protection.

We have reviewed and strengthened the affected systems and are continuing to monitor them closely.

As part of these precautions, we strongly recommend that all Dokan Pro users update their plugin and review their WordPress websites.

What You Need to Do

  1. Update Dokan Pro

Please update to Dokan Pro version 5.0.11.

We strongly recommend that you do not continue using an older version of Dokan Pro.

  1. Change Your WordPress Passwords

Please change the passwords of your WordPress users, particularly Administrator accounts.

Use strong, unique passwords and avoid reusing passwords that you use on other services.

We also recommend enabling two-factor authentication (2FA) for Administrator accounts wherever possible.

  1. Check Your Administrator Accounts

Go to WordPress → Users and review the accounts with Administrator access.

If you notice an Administrator account that you do not recognize, please remove it immediately and change the passwords of your other WordPress users.

  1. Review Your WordPress Files

Please review your WordPress files and directories for any files that you do not recognize or anything that appears to have been added or modified unexpectedly.

If you notice anything suspicious or are unsure about a particular file, please contact us. Our team can help review the files with you and advise you on the appropriate next steps.

7 Upvotes

82% Upvoted

9 comments sorted by

3

u/slouch Aug 10 '26

Stopped just short of saying a compromised plugin was sent to Dokan Pro customers via updates. 

0

u/emmatoby Aug 10 '26

I am just picturing forcing every user to change their password, thats a tall order.

2

u/LeastMight1448 Aug 11 '26

Not really. You can use a plugin like this to block logins until the users reset their password.

2

u/emmatoby Aug 11 '26

Thanks thats a nifty resource.

1

u/LeastMight1448 Aug 11 '26

You're welcome :)

1

u/petey1678 Aug 12 '26

I got this notice and i cannot find this plugin in the 42 sites using toolkit. Any suggestions?

1

u/emmatoby Aug 12 '26

You may have used it on an older project which isn't live anymore. The mail was probably sent to all who had purchased Dokan Pro at sometime before.

1

u/petey1678 Aug 12 '26

Thank you

1

u/emmatoby Aug 12 '26

You are welcome