EUVD-2026-112117
GHSA-qrxq-h8xh-fq8j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privilege user
-
DeliverySubmit crafted serialized payload
-
ExploitTrigger PHP object injection on deserialization
-
ExecutionInvoke POP gadget chain
-
ImpactCompromise confidentiality, integrity and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a high-privilege authenticated account on the WordPress site running Dokan (dokan-lite) version n/a through 5.3.1 (PR:H), with no user interaction needed (UI:N) and network reachability to the admin/plugin surface (AV:N). The specific feature, endpoint, or parameter that accepts the untrusted serialized data is not described in the available sources, and realistic impact additionally depends on a usable PHP object-injection (POP) gadget chain that the evidence does not enumerate. The key limiting factor is the PR:H requirement, which prevents unauthenticated or low-privilege exploitation against default configurations. |
| Impact | This is a CWE-502 PHP Object Injection flaw in the Dokan (dokan-lite) WordPress plugin, scored CVSS 7.2 with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The signals are mixed: the network vector (AV:N) and low attack complexity (AC:L) push severity up, but PR:H means the attacker must already hold high-privilege authenticated access, which materially narrows the realistic attacker population and is the main reason the base score lands at High rather than Critical. The vuln.today decision label is 'this_week', indicating prioritized but not emergency remediation. No CISA KEV listing and no EPSS score were supplied, and there is no confirmed proof-of-concept - the sole reference is a Patchstack vulnerability-database advisory, not verified exploit code. Net assessment: a genuine High-severity issue warranting prompt patching per the 'this_week' label, but not an active-exploitation emergency; the PR:H requirement makes mass, unauthenticated exploitation unlikely absent a separate privilege-gaining bug. Note also that real-world impact of PHP object injection generally depends on an available POP gadget chain, which the available sources do not describe. |
| Exploit ScenarioDerived | An attacker who already holds a high-privilege authenticated account on a Dokan-powered WordPress store submits crafted serialized data to an affected endpoint, triggering PHP object injection during deserialization. Depending on gadget chains present in the plugin or wider WordPress stack, this could lead to code execution, data tampering, or data disclosure (C:H/I:H/A:H). No public exploit identified at time of analysis; the trigger endpoint is not described in available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
PHP object injection in weDevs Dokan (dokan-lite) through 5.3.1 lets a high-privilege authenticated WordPress user trigger deserialization of untrusted data over the network without user interaction, potentially affecting confidentiality, integrity, and availability (CVSS 7.2). The vulnerable endpoint or parameter is not described in the available sources, and practical impact depends on a usable PHP object-injection gadget chain that the evidence does not enumerate. No public exploit identified at time of analysis; vuln.today priority is this_week.
RemediationAI
No fixed version is specified in the provided data; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/dokan-lite/vulnerability/wordpress-dokan-plugin-5-3-1-php-object-injection-vulnerability?_s_id=cve) for current vendor guidance and apply an update when a patched Dokan release is confirmed. Because exploitation requires PR:H, restrict high-privilege WordPress accounts to trusted administrators and audit existing administrator-capable users; if Dokan marketplace functionality is not required, disabling or removing the dokan-lite plugin removes the attack surface at the cost of losing those features. The affected endpoint is not identified, so a targeted request-filtering workaround cannot be specified from the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dokan is a WordPress marketplace plugin, identified by CPE cpe:2.3:a:wedevs:dokan:*:*:*:*:*:*:*:* and affected through 5.3.1. CWE-502 covers deserialization of untrusted data; in PHP this class of flaw can allow attacker-controlled serialized input to instantiate objects and reach magic methods such as __wakeup or __destruct, but exploitation is contingent on the application passing untrusted data to an unserialize path and on a viable POP gadget chain, neither of which is enumerated in the available sources. The CVSS vector shows network reachability, low attack complexity, high privileges required, no user interaction, and high confidentiality/integrity/availability impact; the specific feature, endpoint, or parameter that accepts the serialized data is not described.
Know when Dokan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable deserialization needing a high-privilege account (PR:H) with no user interaction; object injection can yield full C/I/A impact, so AC:L and S:U.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.
Executive ViewAI
The weDevs Dokan (dokan-lite) WordPress plugin through version 5.3.1 contains a high-severity PHP object injection vulnerability that requires a high-privilege authenticated user to exploit. While no public exploit exists, a compromised or malicious high-privilege account could leverage this flaw to potentially access, modify, or disrupt sensitive data and site operations. Leadership should prioritize this because it expands the attack surface for insider threats or credential-stuffing attacks against privileged WordPress users.
No vendor-released patch identified at time of analysis. Restrict high-privilege accounts to essential users, enable multi-factor authentication, monitor for anomalous activity, and consider disabling the Dokan plugin until a fix is available.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and in
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL state
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenti
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level auth
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allo
Unauthenticated privilege escalation in the Blocksy Companion WordPress plugin (versions up to and including 2.1.58) all
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any
Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer a
An authentication bypass vulnerability exists in Dokan (Dokan, Inc.) dokan-lite plugin versions through 4.2.4 that allow
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to mod
The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. Rate
Exploit-DB