Dokan Lite EUVD-2026-116091

The specific vulnerable endpoint, parameter, or configuration is not described in the available sources - the description only states that an authorization check is missing or an access-control security level is incorrectly configured in Dokan up to 5.3.2. Per the CVSS metrics (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required against a WordPress site with the Dokan plugin active at an affected version. Limiting factors: impact is confined to confidentiality at low magnitude (C:L, I:N, A:N), so successful exploitation yields unauthorized read access to some restricted data only - not modification or denial of service - and exposure requires the Dokan plugin to be installed and running a version through 5.3.2.

This is a medium-severity issue with a mixed signal profile. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an easy exploitation path - network-reachable, low complexity, no authentication (PR:N), and no user interaction - which raises exposure. However, the technical impact is deliberately narrow: confidentiality-only and low (C:L/I:N/A:N, CWE-862 Missing Authorization), meaning an attacker gains unauthorized read access to some restricted data rather than full compromise. The vuln.today decision label is 'this_month,' not 'act_now' or 'emergency,' which is consistent with a real-but-non-urgent finding. There is no CISA KEV listing and no active-exploitation signal, so this is not confirmed in the wild. No EPSS score was supplied in the input, so exploitation probability cannot be weighed here - treat that as a gap, not a low score. The only reference is a Patchstack advisory page, not working exploit code. Net: a genuine broken-access-control flaw worth patching in a normal maintenance cycle, elevated by its unauthenticated/low-complexity reachability but bounded by its low confidentiality-only impact - not a drop-everything emergency on current evidence.

An unauthenticated attacker sends a crafted request to a Dokan endpoint whose authorization check is missing or misconfigured on a WordPress site running the plugin at version 5.3.2 or earlier. Because no login or user interaction is required (PR:N/UI:N), the attacker retrieves restricted marketplace/vendor data they should not be able to see. No public exploit code was identified in the provided sources; only a Patchstack advisory reference exists.