CVE-2026-11987: Dokan WooCommerce IDOR Vulnerability

CVE-2026-11987 Overview

CVE-2026-11987 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Dokan AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress. The flaw exists in all versions up to and including 5.0.4. The vulnerability resides in the plugin's REST API, where the id parameter is not validated against the authenticated user's ownership. Authenticated attackers with subscriber-level access or higher can read any other vendor's products, including unpublished draft and pending listings. Exposed data includes product names, prices, SKUs, and descriptions belonging to other vendors on the marketplace [CWE-639].

Critical Impact
Any authenticated user with subscriber-level access can enumerate and read other vendors' private product data, including unpublished drafts, pending listings, prices, and SKUs across the marketplace.

Affected Products

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress
All versions up to and including 5.0.4
WordPress sites running Dokan Lite with vendor/subscriber registration enabled

Discovery Timeline

2026-06-27 - CVE-2026-11987 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-11987

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference in Dokan's REST API endpoints for product management. The ProductController exposes both a collection endpoint and a single-item endpoint that accept an id parameter identifying the target product or vendor author. The plugin trusts this user-supplied identifier without confirming the requesting user owns the referenced object.

The permission callbacks for these endpoints only check whether the requester holds the generic dokan_view_product_menu capability, mapped to the dokandar role. Every registered vendor holds this capability by default. The check confirms the user is a vendor but never confirms the user is the vendor of the requested product. This design conflates role membership with object-level authorization.

Root Cause

The root cause is missing object-level authorization on a user-controlled key. The permission callbacks in includes/Abstracts/DokanRESTController.php and includes/REST/ProductController.php verify a broad capability rather than comparing the authenticated user's ID against the product's author ID. Because the id parameter is directly used to fetch the record without an ownership check, any authenticated vendor can pivot the parameter to another vendor's product ID.

Attack Vector

An attacker registers as a subscriber or vendor on the target marketplace. The attacker then issues authenticated REST API requests to the vulnerable product endpoints, supplying the numeric id of another vendor's product or the target vendor's author ID. Since WordPress product post IDs are sequential, enumeration is trivial. The response returns the target product's full data — including draft and pending items that should never be visible to other vendors. See the Wordfence Vulnerability Report and the Dokan Lite Product Controller source for technical details.

Detection Methods for CVE-2026-11987

Indicators of Compromise

Authenticated REST API requests to /wp-json/dokan/v1/products/{id} where the responding product's author ID does not match the requester's user ID.
Sequential or scripted enumeration of numeric product IDs from a single vendor account within a short time window.
Unexpected access to draft or pending status products by vendors who did not author them.
Elevated request volume to Dokan product endpoints from newly registered subscriber accounts.

Detection Strategies

Review WordPress and web server access logs for high-frequency GET requests against Dokan product REST endpoints originating from a single authenticated session.
Correlate the author field of returned product records with the requesting user's ID to identify cross-vendor reads.
Alert on newly created subscriber or vendor accounts that immediately begin querying product endpoints with varying id values.

Monitoring Recommendations

Enable verbose REST API logging on WordPress and forward logs to a centralized SIEM for correlation.
Monitor for anomalous access patterns to /wp-json/dokan/* endpoints, particularly enumeration behavior.
Track application-layer authorization decisions and flag responses where accessed product ownership differs from the caller.

How to Mitigate CVE-2026-11987

Immediate Actions Required

Update the Dokan plugin to a version newer than 5.0.4 that includes the fix referenced in the WordPress Dokan Changeset.
Audit vendor and subscriber account registrations for anomalous or automated sign-ups.
Review REST API access logs for evidence of cross-vendor product enumeration prior to patching.
Rotate any sensitive product data (SKUs, supplier identifiers) that may have been exposed to unauthorized vendors.

Patch Information

The vendor released a patch tracked in changeset 3578095 for the dokan-lite plugin. The fix updates the permission callbacks in DokanRESTController.php and ProductController.php to validate that the requested product's author ID matches the authenticated user before returning data. Site administrators should upgrade to the fixed release immediately through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Restrict access to the Dokan REST API endpoints at the web server or Web Application Firewall (WAF) layer until the plugin is updated.
Temporarily disable open vendor and subscriber registration to limit the pool of authenticated attackers.
Deploy a WAF rule that inspects id parameters on Dokan product endpoints and blocks requests where the caller's user ID does not match the resource owner.

bash

# Update the Dokan plugin using WP-CLI
wp plugin update dokan-lite
wp plugin get dokan-lite --field=version

# Temporarily block public access to Dokan product REST endpoints (nginx example)
location ~ ^/wp-json/dokan/v[0-9]+/products {
    deny all;
    return 403;
}