---
id: "CVE-2026-115590"
kind: "vulnerability"
aliases: ["CVE-2026-115590"]
title: "Dokan lite WordPress plugin: object injection via untrusted deserialization"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dokan-lite", "package", "self-hosted", "wordpress"]
not_affected_if: []
published_at: "2026-10-28T14:16:57+00:00"
first_seen_at: "2026-10-28T14:33:22+00:00"
updated_at: "2026-10-28T14:34:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115590", "first_seen_at": "2026-10-28T14:33:22+00:00"}]
---

# Dokan lite WordPress plugin: object injection via untrusted deserialization

The Dokan lite WordPress marketplace plugin deserializes untrusted data, which allows PHP object injection. The sources do not say what an attacker can reach beyond that, such as code execution through gadget chains.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dokan lite version in the WordPress admin plugins list or with `wp plugin get dokan-lite --field=version`
- Treat any version up to and including `5.3.1` as affected

## Fix

- Update Dokan lite to a version later than `5.3.1`, as published by weDevs on the WordPress plugin directory
- unknown for the exact patched version number, as the sources do not say

## Timeline

- 2026-10-28T14:33:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115590

## From the sources

Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_