What’s New

New WP-CLI commands for license and module management, plus a round of permission fixes that tighten who can change quotes, categories, and product SEO.

Privacy and security

• Fix: Extended the subscription pack’s category restriction to vendor staff, so staff can no longer assign product categories outside the vendor’s allowance.
• Fix: Required quote ownership before customer-facing quote actions can change a quote’s status, so a customer can’t alter someone else’s quote.
• Fix: Required quote ownership in vendor bulk quote actions, so a vendor can no longer change another vendor’s quote statuses.
• Fix: Scoped the Rank Math SEO capability for vendor staff to their own vendor’s products, so staff can no longer edit other vendors’ product SEO meta.

Vendor dashboard

• Fix: The vendor dashboard now explains when Reports are turned off in the Menu Manager, replacing a misleading “Something went wrong” error, so vendors know the page isn’t broken.

Orders and shipping

• Fix: The legacy Dokan Shipping method no longer offers a rate for addresses outside the locations a vendor covers, so customers aren’t quoted shipping the vendor can’t fulfill.

Admin tools

• New: Added WP-CLI commands for license and module management — wp dokan license and wp dokan module — so provisioning scripts, CI, and staging setup can run from the shell.
• Fix: Fixed pagination on the admin Subscriptions list, so page 2 and beyond now show their own records instead of repeating page 1.

A security-focused patch — hardening quote status changes and abuse reports against misuse — plus a rendering fix for quotes whose products have been deleted.

Privacy and security

• Fix: Required login and quote ownership before a quote’s status can be changed, blocking unauthorized status changes.
• Fix: Sanitized and escaped the abuse report description to prevent stored cross-site scripting (XSS) in abuse reports.

Storefront

• Fix: The Request for Quotation quote details page now renders correctly when a quoted product has been deleted, skipping the removed line item.

A vendor-verification cleanup — clearer onboarding when “Verified Only” selling is on, verification controls that behave — plus fixes to how quote orders and booking limits are handled.

Vendor dashboard

• Update: When “Verified Only” selling is enabled, vendors now see clear next steps and a link to the verification page instead of a generic notice, so they know exactly how to start selling.
• Fix: Vendor verification method help text now renders with its formatting on the React vendor dashboard, matching the legacy dashboard, so the instructions read clearly.
• Fix: The Edit and Delete controls for vendor verification methods are now always visible, and editing or deleting a method now works reliably instead of failing silently.

Products

Fix: The booking product list no longer shows a subscription limit notice while Product Subscription is disabled, and it now honors the vendor’s selling status.

Orders and shipping

Fix: Quote-converted orders are now linked to their vendor so they appear in the vendor’s Orders list, and multi-vendor quotes are split into per-vendor sub-orders.

Customers can now order from vendors who have not finished Stripe Express onboarding, and two surfaces are ready for WordPress 7.1.

Payments

• New: Stripe Express has a new “Allow ordering from non-connected sellers” setting that keeps those vendors’ products purchasable and holds their share of the payment until onboarding is complete.

Products

• Fix: The Booking module stylesheet and the Dokan Shortcode block now load correctly on WordPress 7.1, so booking pages and shortcode blocks render as expected after the upgrade.

Two security patches, plus checkout and shipping-rate fixes for carts that never needed shipping in the first place.

Privacy and security

• Fix: Patched a SQL injection vulnerability in the RMA warranty request listing by binding every filter through prepared statements.
• Fix: Restricted the Dokan Lite installer to users who already hold plugin install and activate permissions, so no one can trigger an install from the admin without the rights to do it.

Orders and shipping

• Fix: Carts holding only products that need no shipping now pass through the WooCommerce block checkout instead of stalling, so customers buying downloadable or virtual items can place their order.
• Fix: Vendor shipping now respects WooCommerce’s “Hide shipping rates when free shipping is available” setting, so customers are shown the free option on its own rather than alongside paid rates.