CVE-2026-11987Disclosure

LOWCVSS 4.3 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read any other vendor's products — including unpublished draft and pending listings — exposing product names, prices, SKUs, and descriptions belonging to other vendors. The permission callbacks for both the collection endpoint and the single-item endpoint only verify the generic vendor capability ('dokan_view_product_menu' / 'dokandar'), which every vendor holds, rather than confirming the requested author ID or product ownership matches the authenticated user.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

Infoflowcloud@infoflowcloud90d
Disclosure
🚨*CVE* CVE-2026-11987 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Re… https://www.cve.org/CVERecord?id=CVE-2026-11987 ----- Traducción: CVE-2026-11987 The… http://infoflow.cloud`
Post summary
The post references CVE‑2026‑11987, identifying it as an insecure direct object reference vulnerability in a WooCommerce Multivendor Marketplace plugin, without providing patches, exploitation evidence, or PoC details.
0001035
89 followersView on X
CVE@CVEnew90d
Disclosure
CVE-2026-11987 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Re… https://www.cve.org/CVERecord?id=CVE-2026-11987
Post summary
The CVE points to an insecure direct object reference flaw in a WooCommerce multivendor plugin, but no PoC, exploit, or patch details are provided.
00010713
57.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-11987 Insecure Direct Object Reference in Dokan Multivendor Marketplace Plugin Up to 5.0.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11987
Post summary
The post announces CVE-2026-11987, identifying an insecure direct object reference in the Dokan Multivendor Marketplace Plugin up to version 5.0.4, but provides no PoC, exploit, or remediation details.
00000108
4.1K followersView on X

Explore more

Back to dashboard