Broken Access Control in weDevs Dokan Plugin
CVE-2026-119487

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Dokan
Vendor
CVE Published:
3 November 2026

What is CVE-2026-119487?

A missing authorization issue has been identified in the weDevs Dokan plugin, specifically within the dokan-lite version, allowing attackers to exploit incorrectly configured access controls. This vulnerability can lead to unauthorized actions being performed by malicious users, compromising the integrity of the application and the data within. Affected versions include 5.3.2 and earlier, emphasizing the importance of ensuring correct access permissions are in place to mitigate potential risks.

Affected Version(s)

Dokan 0 <= 5.3.2

References

https://patchstack.com/database/wordpress/plugin/dokan-li...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aarush Gaur | Patchstack Bug Bounty Program
.