Is CVE-2026-11987 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11987 being exploited in the wild.

How severe is CVE-2026-11987?

Medium severity, with a CVSS score of 4.3, published 27 June 2026.

Which products and versions are affected?

weDevs Dokan Up to and including 5.0.4.

Is there a fix for CVE-2026-11987?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11987 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11987?

Check whether you run weDevs Dokan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11987: weDevs Dokan IDOR in REST API Product Controller

CVE-2026-11987 · Severity: medium · CVSS 4.3 · Published 2026-06-27

The Dokan plugin for WordPress, which allows users to build multi-vendor marketplaces like Amazon or Etsy, contains a security flaw that allows registered vendors to view private information belonging to other sellers. An authenticated user can access unpublished product drafts, pending listings, prices, and SKUs that should not be visible to them. This could lead to the exposure of sensitive business data and competitive intelligence between marketplace participants.

Technologies: weDevs Dokan. Vendors: weDevs.

Quick answers

Is CVE-2026-11987 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11987 being exploited in the wild.
How severe is CVE-2026-11987?: Medium severity, with a CVSS score of 4.3, published 27 June 2026.
Which products and versions are affected?: weDevs Dokan Up to and including 5.0.4.
Is there a fix for CVE-2026-11987?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11987 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11987?: Check whether you run weDevs Dokan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Dokan plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the 'id' parameter in its REST API endpoints. The root cause is a failure in the permission callbacks for both the collection and single-item endpoints, which only verify generic vendor capabilities ('dokan_view_product_menu' or 'dokandar') rather than validating that the requested product belongs to the authenticated user. An attacker with subscriber-level access or higher can exploit this to read sensitive details of any vendor's products, including unpublished drafts and pending listings. This affects all versions up to and including 5.0.4.

Affected products

weDevs Dokan: AI Powered WooCommerce Multivendor Marketplace Solution Up to and including 5.0.4

Timeline

2026-06-27: disclosed: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.