CVE-2026-11987: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read any other vendor's products — including unpublished draft and pending listings — exposing product names, prices, SKUs, and descriptions belonging to other vendors. The permission callbacks for both the collection endpoint and the single-item endpoint only verify the generic vendor capability ('dokanviewproductmenu' / 'dokandar'), which every vendor holds, rather than confirming the requested author ID or product ownership matches the authenticated user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokan: AI Powered WooCommerce Multivendor Marketplace Solutionto a version that resolves this vulnerability.Fixed in 5.0.4 - Configuration
Update the plugin’s permission callbacks for both the collection endpoint and the single-item endpoint so they validate the user-controlled 'id' parameter by confirming the requested author ID or product ownership belongs to the authenticated vendor/user, rather than only checking generic vendor capabilities ('dokan_view_product_menu' / 'dokandar').
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution (WooCommerce multivendor plugin for WordPress) Permission validation for 'id' parameter / ownership checks = Require authorization to confirm requested author ID or product ownership matches the authenticated vendor/user (not only generic capability checks)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11987?
The severity of CVE-2026-11987 is assessed as medium, with a score of 4.3.
How do I fix CVE-2026-11987?
To fix CVE-2026-11987, update the Dokan plugin to version 5.0.5 or later, which addresses the insecure direct object reference.
What does CVE-2026-11987 affect?
CVE-2026-11987 affects all versions of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution up to and including 5.0.4.
What type of vulnerability is CVE-2026-11987?
CVE-2026-11987 is an Insecure Direct Object Reference vulnerability that leads to potential information disclosure.
Who is impacted by CVE-2026-11987?
Users with subscriber-level permissions or higher may be impacted due to the lack of proper validation on the 'id' parameter.