Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.3.1 - Authenticated (Vendor+) PHP Object Injection via Product Meta Data
- ID
- WPSEC-2026-1525
- Plugin
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (dokan-lite)
- Affected
- all versions before 5.3.2
- Remediation
- Update to 5.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution on WPSec AttackSurface
- Fix released
- Published
Description
The Dokan plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.1 via deserialization of untrusted input from the '_product_attributes' and '_default_attributes' product meta, which was passed through maybe_unserialize() after get_post_meta() had already unserialized it. This makes it possible for authenticated attackers with vendor-level access, which can typically be obtained through Dokan's front-end vendor registration, to inject a PHP Object when a product is saved or its edit/variations screen is rendered. No known POP chain is present in the vulnerable software; if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-1525/
- https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.2/
- https://wordpress.org/plugins/dokan-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS