What is the CVSS score of CVE-2026-65493?

CVE-2026-65493 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Dokan Pro are affected by CVE-2026-65493?

Dokan Pro WordPress plugin versions 5.0.2 and earlier contain a PHP Object Injection vulnerability (CVE-2026-65493, CVSS 7.5) exploitable by authenticated subscriber-level users to inject malicious…

How to fix or mitigate CVE-2026-65493?

Within 24 hours, audit your WordPress installations to identify all Dokan Pro deployments running version 5.0.2 or earlier and review active subscriber accounts for legitimacy, disabling unused accounts immediately. Within 7 days, implement network-level monitoring to detect serialized object injection attempts (monitor for 'O:' patterns in POST/GET data), apply principle-of-least-privilege constraints to subscriber roles within Dokan Pro plugin settings, and configure Web Application Firewall rules to block suspicious PHP serialization payloads. Within 30 days, monitor official Dokan security channels for patch availability; when released, prioritize testing and deploying the patched version across all affected instances-do not wait for routine maintenance windows. Parallel to patching: evaluate managed marketplace alternatives with more frequent security release cycles to reduce long-term risk exposure.

Dokan Pro CVE-2026-65493

EUVD-2026-48104 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-23 Patchstack

GHSA-wm63-p9gf-q225

PHP WordPress Deserialization Dokan Wordpress Plugin Dokan Pro

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable with no user interaction but requires a subscriber account (PR:L) and a viable gadget chain (AC:H); successful object injection can fully compromise the site (C:H/I:H/A:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:32 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.5

DescriptionCVE.org

Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.

Articles & Coverage 1

News 10 New PHP Vulnerabilities - 2 Critical, 8 High, 3 With POC Jul 24, 2026

AnalysisAI

PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding only subscriber-level privileges to inject a crafted serialized PHP object, which - if a suitable gadget chain exists in the plugin or its dependencies - can lead to high-impact compromise of confidentiality, integrity, and availability. Reported by Patchstack and tracked as CVE-2026-65493 (CWE-502), it carries a CVSS 3.1 score of 7.5 with high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Dokan Pro is the premium extension of the widely used Dokan multivendor marketplace plugin for WooCommerce/WordPress, adding vendor management, subscriptions, and storefront features. The flaw is a CWE-502 Deserialization of Untrusted Data issue: attacker-controlled input reaches a PHP unserialize() call (or an equivalent deserialization sink), letting the attacker instantiate arbitrary PHP objects. Object injection itself is only dangerous when a 'POP gadget' chain - __wakeup, __destruct, or similar magic methods within the plugin, WordPress core, or bundled libraries - can be triggered to perform file writes, SQL, or code execution. The single affected CPE is cpe:2.3:a:dokan:dokan_pro, and the 'PHP / Deserialization' tags from Patchstack confirm the vulnerability class.

RemediationAI

Upgrade Dokan Pro to a fixed release above 5.0.2 as published by the vendor; the input data does not include an exact patched version number, so no vendor-released patch version is independently confirmed at time of analysis - consult the vendor advisory to confirm the specific release before deploying. Refer to the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-2-php-object-injection-vulnerability?_s_id=cve) for the fixed version and vendor guidance. As compensating controls until patching: restrict or disable open self-service subscriber registration (WordPress Settings > General > 'Anyone can register') to remove the low-privilege foothold the attack requires, accepting that this blocks legitimate new-customer signups; deploy a WordPress WAF (such as Patchstack's own virtual patching) to filter serialized-object payloads reaching Dokan endpoints, noting that object-injection filters can be bypassed; and audit existing subscriber accounts for anomalous activity. These are stopgaps - upgrading remains the durable fix.