CVE-2026-119485: WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that it can be exploited over the network with low attack complexity. No prior privileges or user interaction are required.

Q: What is the expected security impact?

The reported impact is limited to low confidentiality impact. No integrity or availability impact is indicated.

Q: How can I determine whether my site is in scope?

Check the installed Dokan version. The issue is reported to affect versions through 5.3.2; the available data does not specify a lower affected version bound.

Published Nov 3, 2026

Updated

Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.

Event History

Nov 3, 2026

CVE Published

via MITRE·04:57 PM

Data Sourced

via MITRE·04:57 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that it can be exploited over the network with low attack complexity. No prior privileges or user interaction are required.

What is the expected security impact?

The reported impact is limited to low confidentiality impact. No integrity or availability impact is indicated.

How can I determine whether my site is in scope?

Check the installed Dokan version. The issue is reported to affect versions through 5.3.2; the available data does not specify a lower affected version bound.

CVE-2026-119485: WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the expected security impact?

How can I determine whether my site is in scope?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the expected security impact?

How can I determine whether my site is in scope?