Live › vulnerability › CVE-2026-115590
Go to dashboardThe Dokan lite WordPress marketplace plugin deserializes untrusted data, which allows PHP object injection. The sources do not say what an attacker can reach beyond that, such as code execution through gadget chains.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Sites running the Dokan lite plugin at version 5.3.1 or earlier are in scope. The sources do not say which configurations or roles are needed to reach the vulnerable code, so unknown for who can skip it.
No product ranges from the sources yet.
wp plugin get dokan-lite --field=version5.3.1 as affected5.3.1, as published by weDevs on the WordPress plugin directoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-115590")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.