CVE-2026-115590: WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Dokan pluginto a version that resolves this vulnerability.Fixed in 5.3.2
Event History
Frequently Asked Questions
Who would need to exploit this issue?
The CVSS vector lists privileges required as high (PR:H), so an attacker would need high-level privileges in the affected WordPress environment.
What versions are affected?
The issue affects weDevs Dokan Lite through version 5.3.1. No fixed version is provided in the available data.
What is the potential impact if exploited?
The vulnerability is rated high severity with high confidentiality, integrity, and availability impacts in the CVSS vector. It involves deserialization of untrusted data leading to PHP object injection.