CVE-2026-11987

Name of the Vulnerable Software and Affected Versions Dokan: AI Powered WooCommerce Multivendor Marketplace Solution versions prior to 5.0.5

Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or higher can read products from other vendors, including unpublished drafts and pending listings. This exposure includes product names, prices, SKUs, and descriptions. The issue occurs because permission callbacks for the collection and single-item endpoints only verify the generic vendor capability (dokan view product menu / dokandar) instead of confirming that the requested author ID or product ownership matches the authenticated user. The vulnerable parameter is id.

Recommendations Update the plugin to version 5.0.5 or later.