Live › vulnerability › CVE-2026-119485
Dokan Lite, a WordPress marketplace plugin by weDevs, has a missing authorization check that lets users reach functions their role should not allow. The NVD entry rates it medium (CVSS 5.3) and does not describe the exact data or actions exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Sites running Dokan Lite up to and including 5.3.2 are in the affected range, which is an online marketplace built on WordPress. The sources do not say which roles or endpoints are reachable, so unknown whether a logged-out visitor or only a logged-in user with a low role can trigger it.
No product ranges from the sources yet.
wp plugin get dokan-lite --field=version5.3.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-119485")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.