https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:46:09 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-11987 <p>The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the &#39;id&#39; parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read any other vendor&#39;s products — including unpublished draft and pending listings — exposing product names, prices, SKUs, and descriptions belonging to other vendors. The permission callbacks for both the collection endpoint and the single-item endpoint only verify the generic vendor capability (&#39;dokan_view_product_menu&#39; / &#39;dokandar&#39;), which every vendor holds, rather than confirming the requested author ID or product ownership matches the authenticated user.</p> <p>The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the &#39;id&#39; parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read any other vendor&#39;s products — including unpublished draft and pending listings — exposing product names, prices, SKUs, and descriptions belonging to other vendors. The permission callbacks for both the collection endpoint and the single-item endpoint only verify the generic vendor capability (&#39;dokan_view_product_menu&#39; / &#39;dokandar&#39;), which every vendor holds, rather than confirming the requested author ID or product ownership matches the authenticated user.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-11987 https://vulnerability.circl.lu/vuln/ghsa-7w4v-h7g8-xr5r <p>The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the &#39;id&#39; parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read any other vendor&#39;s products — including unpublished draft and pending listings — exposing product names, prices, SKUs, and descriptions belonging to other vendors. The permission callbacks for both the collection endpoint and the single-item endpoint only verify the generic vendor capability (&#39;dokan_view_product_menu&#39; / &#39;dokandar&#39;), which every vendor holds, rather than confirming the requested author ID or product ownership matches the authenticated user.</p> <p>The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the &#39;id&#39; parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read any other vendor&#39;s products — including unpublished draft and pending listings — exposing product names, prices, SKUs, and descriptions belonging to other vendors. The permission callbacks for both the collection endpoint and the single-item endpoint only verify the generic vendor capability (&#39;dokan_view_product_menu&#39; / &#39;dokandar&#39;), which every vendor holds, rather than confirming the requested author ID or product ownership matches the authenticated user.</p> https://vulnerability.circl.lu/vuln/ghsa-7w4v-h7g8-xr5r