What’s New

A security-hardening release: five ownership checks that ensure vendors can only view or change the shipping rates, subscriptions, and verification records that belong to them.

Privacy and security

• Fix: Restricted Table Rate Shipping rates so only the vendor who owns the shipping method can view, change, or delete them.
• Fix: Restricted Distance Rate Shipping settings so only the vendor who owns the shipping method can view, change, or delete them.
• Fix: Scoped vendor subscription schedule changes to the vendor’s own subscription, so one vendor can no longer alter another’s schedule.
• Fix: Scoped vendor subscription status changes to the vendor’s own subscription, so one vendor can no longer alter another’s status.
• Fix: Scoped the verification requests list to the current vendor, so each vendor sees only their own identity documents.

The Stripe Connect gateway now offers Apple Pay, Google Pay, Link, and other modern Stripe payment methods, built on a new PaymentIntents flow with SCA support.

Payments

• New: Added Stripe Payment Elements to the Stripe Connect gateway on both classic and block checkout, so customers can pay with Apple Pay, Google Pay, Link, and other modern Stripe payment methods.
• Update: Stripe Connect now processes payments through a unified PaymentIntents flow with built-in Strong Customer Authentication (SCA) support, so card payments that require extra verification complete without being declined.

Admin tools

• Fix: The Germanized company and tax fields on the legacy Add Vendor form now line up correctly across both columns.

Four fixes: subscription coupons and pack limits behave correctly, WooCommerce 11.0.1 compatibility is restored, and the Vendor Staff API now checks ownership.

Payments

• Fix: Percentage-based subscription coupons (Sign Up Fee and Recurring) now display as percentages instead of currency amounts, so the discount reads correctly.

Privacy and security

• Fix: Added staff-ownership checks across the Vendor Staff API, so a vendor can only manage and delete their own staff members.

Products

• Fix: The subscription pack’s allowed categories and gallery image limit are now enforced whenever a product is saved — including in the new product editor and via the API — so vendors can’t exceed their pack’s allowance.
• Fix: Restored WooCommerce 11.0.1 compatibility across CSV import, coupon product search (GTIN), vendor order item meta, and booking line items, so these work again on the latest WooCommerce.

New WP-CLI commands for license and module management, plus a round of permission fixes that tighten who can change quotes, categories, and product SEO.

Privacy and security

• Fix: Extended the subscription pack’s category restriction to vendor staff, so staff can no longer assign product categories outside the vendor’s allowance.
• Fix: Required quote ownership before customer-facing quote actions can change a quote’s status, so a customer can’t alter someone else’s quote.
• Fix: Required quote ownership in vendor bulk quote actions, so a vendor can no longer change another vendor’s quote statuses.
• Fix: Scoped the Rank Math SEO capability for vendor staff to their own vendor’s products, so staff can no longer edit other vendors’ product SEO meta.

Vendor dashboard

• Fix: The vendor dashboard now explains when Reports are turned off in the Menu Manager, replacing a misleading “Something went wrong” error, so vendors know the page isn’t broken.

Orders and shipping

• Fix: The legacy Dokan Shipping method no longer offers a rate for addresses outside the locations a vendor covers, so customers aren’t quoted shipping the vendor can’t fulfill.

Admin tools

• New: Added WP-CLI commands for license and module management — wp dokan license and wp dokan module — so provisioning scripts, CI, and staging setup can run from the shell.
• Fix: Fixed pagination on the admin Subscriptions list, so page 2 and beyond now show their own records instead of repeating page 1.

A security-focused patch — hardening quote status changes and abuse reports against misuse — plus a rendering fix for quotes whose products have been deleted.

Privacy and security

• Fix: Required login and quote ownership before a quote’s status can be changed, blocking unauthorized status changes.
• Fix: Sanitized and escaped the abuse report description to prevent stored cross-site scripting (XSS) in abuse reports.

Storefront

• Fix: The Request for Quotation quote details page now renders correctly when a quoted product has been deleted, skipping the removed line item.