CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19.
Explanation of Vulnerability in Simple Terms
Dokan versions up to 3.7.19 contain a deserialization vulnerability in how the plugin processes untrusted data. An authenticated admin with high privileges can craft a malicious request that causes the plugin to deserialize and execute arbitrary code. The vulnerability requires high attack complexity and affects data confidentiality and integrity across the site.
What an attacker can do
Read or modify sensitive site data by sending a specially crafted request.
Potential impact on your site
A compromised admin account could leak customer data or alter marketplace settings without detection.
Conditions required to exploit
Admin-level access to the WordPress site; attacker must be authenticated with high privileges.
Key dates
External resources
Related vulnerabilities
