{"id":"CVE-2026-119487","kind":"vulnerability","aliases":["CVE-2026-119487"],"related":[],"title":"Dokan Lite WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.","summary":"Dokan Lite, a WooCommerce marketplace plugin for WordPress, has a missing authorization check that lets access control settings be bypassed. Per the NVD entry, an attacker can exploit incorrectly configured access control levels in versions through 5.3.2.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dokan-lite","marketplace","package","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Dokan Lite version in the WordPress admin plugins list, or with `wp plugin get dokan-lite --field=version`\n- Compare it against the affected range: versions through `5.3.2`","fix":"- Dokan Lite: a fixed version is not stated in the sources; unknown","status":"open","published_at":"2026-11-03T17:18:06+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","triaged_at":"2026-11-03T17:24:28+00:00","updated_at":"2026-11-03T17:24:28+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T17:24:28Z","model":"claude-haiku-5-5","output":{"fix":"- Dokan Lite: a fixed version is not stated in the sources; unknown","reach":"internet","title":"Dokan Lite WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"Dokan Lite, a WooCommerce marketplace plugin for WordPress, has a missing authorization check that lets access control settings be bypassed. Per the NVD entry, an attacker can exploit incorrectly configured access control levels in versions through 5.3.2.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","dokan-lite","marketplace"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may bypass intended access restrictions on marketplace data","analyst_note":"Find the fixed Dokan Lite version and the affected endpoints in the NVD entry and the vendor changelog (https://nvd.nist.gov/vuln/detail/CVE-2026-119487).","how_to_check":"- Check the installed Dokan Lite version in the WordPress admin plugins list, or with `wp plugin get dokan-lite --field=version`\n- Compare it against the affected range: versions through `5.3.2`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Dokan Lite plugin on WordPress with WooCommerce marketplace features enabled are in scope, up to and including version 5.3.2. The sources do not describe the exact configuration needed to reach the flaw, so sites that do not run Dokan Lite can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4109,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119487':13A,16A '-2026':12A,15A '5.3.2':60B,84C 'access':9A,39B,54B,74C 'affect':79C 'allow':70C 'attack':49B 'author':6A,35B,62C 'bypass':43B 'check':7A,36B 'configur':53B,73C 'control':10A,40B,55B,75C 'cve':11A,14A 'dokan':1A,18B,24B,66C,68C,80C 'dokan-lit':17B,67C 'entri':47B 'exploit':51B,71C 'expos':8A 'incorrect':52B,72C 'issu':78C 'let':38B 'level':56B 'levels.this':77C 'lite':2A,19B,25B,69C 'marketplac':20B,28B 'miss':5A,34B,61C 'n/a':82C 'nvd':46B 'packag':21B 'per':44B 'plugin':4A,29B 'secur':76C 'set':41B 'version':58B 'vulner':63C 'wedev':65C 'woocommerc':22B,27B 'wordpress':3A,23B,31B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Dokan Lite plugin on WordPress with WooCommerce marketplace features enabled are in scope, up to and including version 5.3.2. The sources do not describe the exact configuration needed to reach the flaw, so sites that do not run Dokan Lite can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dokanlite","marketplace","medium","package","woocommerce","wordpress"],"campaign_type":null,"first_public_at":"2026-11-03T17:18:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119487","severity":null,"published_at":"2026-11-03T17:18:06+00:00","modified_at":"2026-11-03T17:18:06+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","fetched_at":"2026-11-03T17:21:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}