{
 "id": "WPSEC-2026-2214",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2214/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2214/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2214/index.md",
 "title": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.3.2 - Unauthenticated Sensitive Information Exposure via Product REST API",
 "description": "The Dokan plugin for WordPress is vulnerable to Sensitive Information Exposure via the public product REST endpoints in all versions up to, and including, 5.3.2 due to the shared product serializer returning vendor-only fields to any caller. This makes it possible for unauthenticated attackers to retrieve downloadable product file links, all product meta data, purchase notes, vendor earnings and edit URLs, which may allow access to paid downloadable files without purchasing them.",
 "plugin": {
  "slug": "dokan-lite",
  "name": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution",
  "full_name": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy",
  "wordpress_org": "https://wordpress.org/plugins/dokan-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/dokan-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/dokan-lite"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.3.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.3.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.3.3",
 "remediation": "Update to 5.3.3 or later.",
 "fix_released": "2026-10-30T13:17:29+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:20:06.378458+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2214/",
  "https://plugins.svn.wordpress.org/dokan-lite/tags/5.3.3/",
  "https://wordpress.org/plugins/dokan-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/dokan-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}