---
id: "CVE-2026-119485"
kind: "vulnerability"
aliases: ["CVE-2026-119485"]
title: "Dokan Lite WordPress plugin: missing authorization check exposes access controls"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dokan-lite", "marketplace", "package", "woocommerce", "wordpress"]
not_affected_if: ["dokan-lite-not-installed", "version-above-5.3.2"]
published_at: "2026-11-03T17:18:05+00:00"
first_seen_at: "2026-11-03T17:21:55+00:00"
updated_at: "2026-11-03T17:24:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119485", "first_seen_at": "2026-11-03T17:21:55+00:00"}]
---

# Dokan Lite WordPress plugin: missing authorization check exposes access controls

Dokan Lite, a WordPress marketplace plugin by weDevs, has a missing authorization check that lets users reach functions their role should not allow. The NVD entry rates it medium (CVSS 5.3) and does not describe the exact data or actions exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dokan Lite version in the WordPress admin plugin list or `wp plugin get dokan-lite --field=version`
- Compare it against the affected range: versions through `5.3.2`

## Fix

- Dokan Lite: a fixed version is not stated in the sources; unknown

## Timeline

- 2026-11-03T17:21:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119485

## From the sources

Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_