Dokan Lite CVE-2026-119487

The available sources do not name the specific endpoint, feature, or configuration involved; the description only states a missing-authorization flaw in Dokan 'Incorrectly Configured Access Control Security Levels,' so the precise trigger is not described in the available sources. Per the CVSS vector (PR:N/UI:N/AC:L), exploitation requires no authentication, no user interaction, and low complexity, meaning it is reachable against a default network-exposed installation. The main limiting factor is impact scope: only low confidentiality (C:L, no integrity or availability), and exploitation is bounded to sites running an affected Dokan version (through 5.3.2).

This is a moderate, not emergency-grade, issue despite its network-facing CVSS vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) indicates a remotely reachable, low-complexity flaw requiring no privileges or user interaction, but the impact is narrow: low confidentiality only, with no integrity or availability effect (C:L/I:N/A:N). This pattern - a missing-authorization/broken-access-control bug reported by Patchstack - typically maps to unauthorized read access to data that should be access-controlled, consistent with CWE-862. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The vulnerability is NOT on the CISA KEV list and there is no SSVC-style exploitation signal beyond the vuln.today 'this_month' priority label, which aligns with a 'patch on a normal cycle' posture rather than act_now/emergency. The single reference is a Patchstack database entry describing the vulnerability, not verified working exploit code, so active or public exploitation is not established. Net: a genuine but limited-impact information-exposure issue in a popular WordPress plugin - worth remediating on a routine monthly cadence, not a drop-everything event.

A remote, unauthenticated attacker sends a request to a Dokan-powered WordPress site targeting a plugin endpoint whose authorization check is missing or misconfigured, and retrieves data that should have been access-restricted. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no login, user interaction, or special timing is needed, but impact is limited to confidentiality (C:L) - no data modification or service disruption. No public exploit code was identified in the provided sources; only a Patchstack vulnerability database reference exists.