CVE Database /
CVE-2026-11987
CVE · Medium
CVE-2026-11987 — Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.5
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-11987
|
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite] < 5.0.5 |
Authorization Bypass Through User-Controlled Key |
Medium
4.3
|
< 5.0.5
|
5.0.5 |
2026-06-26 |
—
|
CVE-2026-11987
The Dokan multivendor marketplace plugin has a flaw in its handling of user-controlled keys. Specifically, versions 5.0.4 and earlier fail to properly validate the 'id' parameter, allowing attackers with subscriber-level access or higher to view products from other vendors. This includes unpublished draft and pending listings, exposing sensitive information such as product names, prices, SKUs, and descriptions owned by other vendors.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings