{"id":"CVE-2026-119485","kind":"vulnerability","aliases":["CVE-2026-119485"],"related":[],"title":"Dokan Lite WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.","summary":"Dokan Lite, a WordPress marketplace plugin by weDevs, has a missing authorization check that lets users reach functions their role should not allow. The NVD entry rates it medium (CVSS 5.3) and does not describe the exact data or actions exposed.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dokan-lite","marketplace","package","woocommerce","wordpress"],"not_affected_if":["dokan-lite-not-installed","version-above-5.3.2"],"how_to_check":"- Check the installed Dokan Lite version in the WordPress admin plugin list or `wp plugin get dokan-lite --field=version`\n- Compare it against the affected range: versions through `5.3.2`","fix":"- Dokan Lite: a fixed version is not stated in the sources; unknown","status":"open","published_at":"2026-11-03T17:18:05+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","triaged_at":"2026-11-03T17:24:28+00:00","updated_at":"2026-11-03T17:24:28+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T17:24:28Z","model":"claude-haiku-5-5","output":{"fix":"- Dokan Lite: a fixed version is not stated in the sources; unknown","reach":"unknown","title":"Dokan Lite WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"Dokan Lite, a WordPress marketplace plugin by weDevs, has a missing authorization check that lets users reach functions their role should not allow. The NVD entry rates it medium (CVSS 5.3) and does not describe the exact data or actions exposed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","dokan-lite","marketplace","woocommerce"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to marketplace functions reachable by lower-privileged users","analyst_note":"Find the NVD detail and the weDevs advisory to confirm which endpoint is missing the check, the required role, and the fixed version.","how_to_check":"- Check the installed Dokan Lite version in the WordPress admin plugin list or `wp plugin get dokan-lite --field=version`\n- Compare it against the affected range: versions through `5.3.2`\n- unknown whether any other setting changes exposure","plain_action":"","needs_analyst":true,"not_affected_if":["dokan-lite-not-installed","version-above-5.3.2"],"who_is_affected":"Sites running Dokan Lite up to and including 5.3.2 are in the affected range, which is an online marketplace built on WordPress. The sources do not say which roles or endpoints are reachable, so unknown whether a logged-out visitor or only a logged-in user with a low role can trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00072,"input_tokens":4109,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119485':13A,16A '-2026':12A,15A '5.3':54B '5.3.2':88C 'access':9A,78C 'action':63B 'affect':83C 'allow':46B,74C 'author':6A,35B,66C 'check':7A,36B 'configur':77C 'control':10A,79C 'cve':11A,14A 'cvss':53B 'data':61B 'describ':58B 'dokan':1A,18B,24B,70C,72C,84C 'dokan-lit':17B,71C 'entri':49B 'exact':60B 'exploit':75C 'expos':8A,64B 'function':41B 'incorrect':76C 'issu':82C 'let':38B 'levels.this':81C 'lite':2A,19B,25B,73C 'marketplac':20B,28B 'medium':52B 'miss':5A,34B,65C 'n/a':86C 'nvd':48B 'packag':21B 'plugin':4A,29B 'rate':50B 'reach':40B 'role':43B 'secur':80C 'user':39B 'vulner':67C 'wedev':31B,69C 'woocommerc':22B 'wordpress':3A,23B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running Dokan Lite up to and including 5.3.2 are in the affected range, which is an online marketplace built on WordPress. The sources do not say which roles or endpoints are reachable, so unknown whether a logged-out visitor or only a logged-in user with a low role can trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dokanlite","marketplace","medium","package","woocommerce","wordpress"],"campaign_type":null,"first_public_at":"2026-11-03T17:18:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119485","severity":null,"published_at":"2026-11-03T17:18:05+00:00","modified_at":"2026-11-03T17:18:05+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","fetched_at":"2026-11-03T17:21:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}