What is the CVSS score of CVE-2026-65493?

CVE-2026-65493 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Dokan Pro are affected by CVE-2026-65493?

Dokan Pro WordPress plugin versions 5.0.2 and earlier contain a PHP Object Injection vulnerability (CVE-2026-65493, CVSS 7.5) exploitable by authenticated subscriber-level users to inject malicious…

How to fix or mitigate CVE-2026-65493?

Within 24 hours, audit your WordPress installations to identify all Dokan Pro deployments running version 5.0.2 or earlier and review active subscriber accounts for legitimacy, disabling unused accounts immediately. Within 7 days, implement network-level monitoring to detect serialized object injection attempts (monitor for 'O:' patterns in POST/GET data), apply principle-of-least-privilege constraints to subscriber roles within Dokan Pro plugin settings, and configure Web Application Firewall rules to block suspicious PHP serialization payloads. Within 30 days, monitor official Dokan security channels for patch availability; when released, prioritize testing and deploying the patched version across all affected instances-do not wait for routine maintenance windows. Parallel to patching: evaluate managed marketplace alternatives with more frequent security release cycles to reduce long-term risk exposure.

Dokan Pro CVE-2026-65493

EUVD-2026-48104 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-23 Patchstack

GHSA-wm63-p9gf-q225

PHP Deserialization Dokan Pro

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable with no user interaction but requires a subscriber account (PR:L) and a viable gadget chain (AC:H); successful object injection can fully compromise the site (C:H/I:H/A:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:32 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.5

DescriptionCVE.org

Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.

Articles & Coverage 1

News 10 New PHP Vulnerabilities - 2 Critical, 8 High, 3 With POC Jul 24, 2026

AnalysisAI

PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding only subscriber-level privileges to inject a crafted serialized PHP object, which - if a suitable gadget chain exists in the plugin or its dependencies - can lead to high-impact compromise of confidentiality, integrity, and availability. Reported by Patchstack and tracked as CVE-2026-65493 (CWE-502), it carries a CVSS 3.1 score of 7.5 with high attack complexity. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Delivery

Craft malicious serialized PHP object

Exploit

Submit payload to vulnerable Dokan input

Execution

unserialize triggers POP gadget chain

Persist

Achieve file write or code execution

Impact

Compromise WordPress site

Access

Delivery

Craft malicious serialized PHP object

Exploit

Submit payload to vulnerable Dokan input

Execution

unserialize triggers POP gadget chain

Persist

Achieve file write or code execution

Impact

Compromise WordPress site

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated account with at least subscriber-level privileges on the target WordPress site (CVSS PR:L), which is trivially obtainable where open user registration is enabled - the common default for storefronts. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.5 (High): network-reachable with no user interaction (UI:N), but gated by low-privilege authentication (PR:L, a subscriber account) and high attack complexity (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a free subscriber account on a WooCommerce site running Dokan Pro <= 5.0.2, then submits a crafted serialized PHP object to a vulnerable Dokan input that is passed to unserialize(). If a usable gadget chain is present, the deserialization triggers magic methods leading to arbitrary file operations, data disclosure, or code execution in the WordPress context. …
Remediation	Upgrade Dokan Pro to a fixed release above 5.0.2 as published by the vendor; the input data does not include an exact patched version number, so no vendor-released patch version is independently confirmed at time of analysis - consult the vendor advisory to confirm the specific release before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit your WordPress installations to identify all Dokan Pro deployments running version 5.0.2 or earlier and review active subscriber accounts for legitimacy, disabling unused accounts immediately. …

Threat intelligence, references, and detailed analysis are available after sign-in.