{
 "id": "WPSEC-2026-1525",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1525/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1525/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1525/index.md",
 "title": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.3.1 - Authenticated (Vendor+) PHP Object Injection via Product Meta Data",
 "description": "The Dokan plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.1 via deserialization of untrusted input from the '_product_attributes' and '_default_attributes' product meta, which was passed through maybe_unserialize() after get_post_meta() had already unserialized it. This makes it possible for authenticated attackers with vendor-level access, which can typically be obtained through Dokan's front-end vendor registration, to inject a PHP Object when a product is saved or its edit/variations screen is rendered. No known POP chain is present in the vulnerable software; if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
 "plugin": {
  "slug": "dokan-lite",
  "name": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution",
  "full_name": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy",
  "wordpress_org": "https://wordpress.org/plugins/dokan-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/dokan-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/dokan-lite"
 },
 "type": "OBJECT INJECTION",
 "cwe": [
  "CWE-502"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.3.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.3.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.3.2",
 "remediation": "Update to 5.3.2 or later.",
 "fix_released": "2026-10-22T13:29:11+00:00",
 "published": "2026-10-23T13:44:58+00:00",
 "updated": "2026-10-23T09:48:55.742343+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1525/",
  "https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.2/",
  "https://wordpress.org/plugins/dokan-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/dokan-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-23"
 }
}