CVE-2026-11987: Dokan Plugin IDOR Exposes Competitor Product Data in WooCommerce Marketplaces

Technical summary

CVE-2026-11987 is an Insecure Direct Object Reference (IDOR) vulnerability in the Dokan plugin affecting versions up to 5.0.4. The REST API endpoints handling product retrieval rely solely on generic capability checks ('dokan_view_product_menu' and 'dokandar') without validating that the authenticated user's ID matches the product's author or that the user has explicit ownership rights. An attacker supplies a target product ID via the 'id' parameter, and the missing authorization layer permits access. The vulnerability affects both collection and single-item endpoints, allowing enumeration and disclosure of products across the marketplace.

Business impact

Multi-vendor marketplace operators face confidentiality breaches of competitor product intelligence. Vendors can discover each other's pricing strategies, SKUs, and product roadmaps (via draft items), undermining competitive trust and potentially violating confidentiality agreements. Exposure of pending listings may reveal unreleased products prematurely. For platforms handling sensitive goods or time-sensitive launches, this represents material business risk. The attack requires only low privilege (subscriber access), making it accessible to any registered user, including competitors who sign up as vendors.

Affected systems

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin in all versions up to and including 5.0.4 is affected. Installations running WooCommerce with Dokan enabled and configured for multi-vendor mode are at risk. Only authenticated users (subscriber level or above) can exploit the vulnerability, so open registration marketplaces or those allowing trial vendor accounts face higher exposure.

Exploitability

Exploitability is straightforward and requires no special tools. An attacker with a vendor account (or subscriber account if permissions allow) can craft REST API requests targeting product IDs of competitors. No user interaction is needed, and the attack is unauthenticated from the victim's perspective—the victim is unaware their product metadata is being read. The low CVSS score (4.3 MEDIUM) reflects the requirement for prior authentication and the confidentiality-only impact, but the ease of execution and broad applicability across multi-vendor sites make practical risk higher than the numeric score suggests.

Remediation

Upgrade to a patched version of Dokan released after June 29, 2026. Verify the patch version against the vendor's official security advisory. Until patching is possible, implement network-level access controls restricting REST API endpoints to trusted origins, or temporarily disable the REST API if the multivendor feature is not in active use. Review API logs for suspicious enumeration patterns (repeated requests with varying product IDs from the same user).

Patch guidance

Check the official Dokan or WordPress.org plugin repository for version updates released on or after June 30, 2026. Apply the patch during a maintenance window. Verify the fix by reviewing the plugin's changelog for explicit mention of authorization checks on the product retrieval endpoints. If you are a marketplace operator, test the patch in a staging environment to confirm vendors can only see their own products and publicly published listings. After deployment, monitor vendor reports of unexpected product visibility.

Detection guidance

Monitor WooCommerce REST API logs for patterns such as: (1) a single user requesting product data for multiple IDs in rapid succession, especially if the IDs belong to different vendors; (2) requests to product endpoints for unpublished or draft posts (HTTP 200 responses for draft content); (3) subscriber-level accounts making repeated API calls to product endpoints. Enable WordPress security logging plugins to capture failed authorization events. Review vendor access logs for anomalous browsing of competitor product pages if the marketplace UI also reflects API-level visibility.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), prioritization depends on your marketplace architecture. If you operate a competitive B2B or sensitive-goods marketplace where vendors treat product roadmaps as proprietary, this is HIGH priority due to business impact. If your marketplace is public-facing with primarily public listings, priority is lower. All instances should be patched promptly because the attack is trivial to execute and requires only authentication—no advanced skills needed—and because the scope of exposure (all products, all vendors) is broad.

Risk score, explained

CVSS 3.1 score of 4.3 (MEDIUM) is driven by: low attack complexity (Network, no special conditions); low privilege requirement (Subscriber account); no user interaction required; and confidentiality impact (Low) limited to product metadata. Integrity and availability are unaffected. The score appropriately reflects the technical severity, but real-world risk assessment should consider marketplace-specific factors: multi-vendor platforms inherently treat product data as sensitive IP, and competitor intelligence leaks may trigger legal or contractual consequences. Organizations should not dismiss this as low-risk simply because the CVSS number is moderate.

Frequently asked questions