{"id":"CVE-2026-115590","kind":"vulnerability","aliases":["CVE-2026-115590"],"related":[],"title":"Dokan lite WordPress plugin: object injection via untrusted deserialization","description":"Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.","summary":"The Dokan lite WordPress marketplace plugin deserializes untrusted data, which allows PHP object injection. The sources do not say what an attacker can reach beyond that, such as code execution through gadget chains.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dokan-lite","package","self-hosted","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed Dokan lite version in the WordPress admin plugins list or with `wp plugin get dokan-lite --field=version`\n- Treat any version up to and including `5.3.1` as affected","fix":"- Update Dokan lite to a version later than `5.3.1`, as published by weDevs on the WordPress plugin directory\n- unknown for the exact patched version number, as the sources do not say","status":"open","published_at":"2026-10-28T14:16:57+00:00","first_seen_at":"2026-10-28T14:33:22+00:00","triaged_at":"2026-10-28T14:34:30+00:00","updated_at":"2026-10-28T14:34:30+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T14:34:30Z","model":"claude-haiku-5-5","output":{"fix":"- Update Dokan lite to a version later than `5.3.1`, as published by weDevs on the WordPress plugin directory\n- unknown for the exact patched version number, as the sources do not say","reach":"unknown","title":"Dokan lite WordPress plugin: object injection via untrusted deserialization","impact":"high","summary":"The Dokan lite WordPress marketplace plugin deserializes untrusted data, which allows PHP object injection. The sources do not say what an attacker can reach beyond that, such as code execution through gadget chains.","category":"package","nicknames":[],"who_cares":["wordpress","dokan-lite","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; object injection may allow code run on the server","analyst_note":"Confirm the patched version, required privileges and whether a gadget chain exists, using the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-115590 and the weDevs changelog.","how_to_check":"- Check the installed Dokan lite version in the WordPress admin plugins list or with `wp plugin get dokan-lite --field=version`\n- Treat any version up to and including `5.3.1` as affected","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the Dokan lite plugin at version 5.3.1 or earlier are in scope. The sources do not say which configurations or roles are needed to reach the vulnerable code, so unknown for who can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000608,"input_tokens":3287,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115590':12A,15A '-2026':11A,14A '5.3.1':77C 'affect':72C 'allow':34B,68C 'attack':45B 'beyond':48B 'chain':56B 'code':52B 'cve':10A,13A 'data':32B,60C 'deseri':9A,30B,57C 'dokan':1A,17B,25B,64C,66C,73C 'dokan-lit':16B,65C 'execut':53B 'gadget':55B 'host':22B 'inject':6A,37B 'injection.this':70C 'issu':71C 'lite':2A,18B,26B,67C 'marketplac':28B 'n/a':75C 'object':5A,36B,69C 'packag':19B 'php':35B 'plugin':4A,29B 'reach':47B 'say':42B 'self':21B 'self-host':20B 'sourc':39B 'untrust':8A,31B,59C 'via':7A 'vulner':61C 'wedev':63C 'wordpress':3A,23B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Dokan lite plugin at version 5.3.1 or earlier are in scope. The sources do not say which configurations or roles are needed to reach the vulnerable code, so unknown for who can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T14:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115590","severity":null,"published_at":"2026-10-28T14:16:57+00:00","modified_at":"2026-10-28T14:16:57+00:00","first_seen_at":"2026-10-28T14:33:22+00:00","fetched_at":"2026-10-28T14:33:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}