EUVD-2026-48104
GHSA-wm63-p9gf-q225
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister subscriber account on target site
-
DeliveryCraft malicious serialized PHP object
-
ExploitSubmit payload to vulnerable Dokan input
-
Executionunserialize triggers POP gadget chain
-
PersistAchieve file write or code execution
-
ImpactCompromise WordPress site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with at least subscriber-level privileges on the target WordPress site (CVSS PR:L), which is trivially obtainable where open user registration is enabled - the common default for storefronts. The site must be running Dokan Pro version 5.0.2 or earlier with the vulnerable deserialization code path reachable by a subscriber. Limiting factors: attack complexity is High (AC:H), reflecting that meaningful impact depends on a suitable PHP POP gadget chain being available in the plugin, WordPress core, or loaded libraries; sites that disable public registration remove the required foothold entirely. No user interaction is needed (UI:N) and the vector is remote (AV:N). |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.5 (High): network-reachable with no user interaction (UI:N), but gated by low-privilege authentication (PR:L, a subscriber account) and high attack complexity (AC:H). The AC:H rating is consistent with PHP object injection, which typically requires a viable gadget chain to achieve real impact - raw injection without a usable chain may fail. No EPSS score was supplied in the input, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; likewise no public POC is referenced. The realistic priority is moderate: the C:H/I:H/A:H impact and the low bar of a subscriber account (self-registration is common on WooCommerce sites) raise concern, but AC:H and the absence of exploitation signals argue against emergency treatment. Note a data gap: the exact fix version and whether an exploitable gadget chain ships by default are not confirmed in the provided data. |
| Exploit ScenarioDerived | An attacker registers a free subscriber account on a WooCommerce site running Dokan Pro <= 5.0.2, then submits a crafted serialized PHP object to a vulnerable Dokan input that is passed to unserialize(). If a usable gadget chain is present, the deserialization triggers magic methods leading to arbitrary file operations, data disclosure, or code execution in the WordPress context. No public POC is referenced, and the high attack complexity reflects the need to identify a working gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding only subscriber-level privileges to inject a crafted serialized PHP object, which - if a suitable gadget chain exists in the plugin or its dependencies - can lead to high-impact compromise of confidentiality, integrity, and availability. Reported by Patchstack and tracked as CVE-2026-65493 (CWE-502), it carries a CVSS 3.1 score of 7.5 with high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Upgrade Dokan Pro to a fixed release above 5.0.2 as published by the vendor; the input data does not include an exact patched version number, so no vendor-released patch version is independently confirmed at time of analysis - consult the vendor advisory to confirm the specific release before deploying. Refer to the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-2-php-object-injection-vulnerability?_s_id=cve) for the fixed version and vendor guidance. As compensating controls until patching: restrict or disable open self-service subscriber registration (WordPress Settings > General > 'Anyone can register') to remove the low-privilege foothold the attack requires, accepting that this blocks legitimate new-customer signups; deploy a WordPress WAF (such as Patchstack's own virtual patching) to filter serialized-object payloads reaching Dokan endpoints, noting that object-injection filters can be bypassed; and audit existing subscriber accounts for anomalous activity. These are stopgaps - upgrading remains the durable fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dokan Pro is the premium extension of the widely used Dokan multivendor marketplace plugin for WooCommerce/WordPress, adding vendor management, subscriptions, and storefront features. The flaw is a CWE-502 Deserialization of Untrusted Data issue: attacker-controlled input reaches a PHP unserialize() call (or an equivalent deserialization sink), letting the attacker instantiate arbitrary PHP objects. Object injection itself is only dangerous when a 'POP gadget' chain - __wakeup, __destruct, or similar magic methods within the plugin, WordPress core, or bundled libraries - can be triggered to perform file writes, SQL, or code execution. The single affected CPE is cpe:2.3:a:dokan:dokan_pro, and the 'PHP / Deserialization' tags from Patchstack confirm the vulnerability class.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable with no user interaction but requires a subscriber account (PR:L) and a viable gadget chain (AC:H); successful object injection can fully compromise the site (C:H/I:H/A:H).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.
Articles & Coverage 1
Executive ViewAI
Dokan Pro WordPress plugin versions 5.0.2 and earlier contain a PHP Object Injection vulnerability (CVE-2026-65493, CVSS 7.5) exploitable by authenticated subscriber-level users to inject malicious serialized objects. Organizations operating multi-vendor marketplaces using this plugin face potential unauthorized access to sensitive data, website manipulation, and service disruption if subscriber accounts are compromised or misused. The absence of vendor patches makes immediate operational controls critical to reduce exposure.
No vendor-released patch identified at time of analysis. Implement strict role-based access controls limiting subscriber capabilities within Dokan Pro; restrict subscriber account creation to trusted vendor partners only; enable and monitor detailed activity logs for unauthorized serialization attempts; maintain daily encrypted backups to enable rapid restoration if compromise occurs; isolate vulnerable WordPress instances on segmented network zones; monitor database query patterns and file modifications for post-exploitation indicators. These controls substantially reduce risk but do not eliminate it-patch deployment remains essential upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB