Insecure Direct Object Reference in Dokan WooCommerce Plugin for WordPress
CVE-2026-11987
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 27 June 2026
What is CVE-2026-11987?
The Dokan plugin for WordPress suffers from an Insecure Direct Object Reference (IDOR) in the 'id' parameter, which affects all versions up to and including 5.0.4. This vulnerability allows authenticated users with subscriber-level access and above to view other vendors' product listings, including unpublished drafts and pending items. The inadequate validation of user-controlled keys in permission callbacks only checks for generic vendor capabilities (e.g., 'dokan_view_product_menu') without verifying the ownership of the requested author ID or product. As a result, sensitive product information such as names, prices, SKUs, and descriptions may be exposed, posing a significant risk to vendors' privacy and data integrity.
Affected Version(s)
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy 0 <= 5.0.4