CVE-2026-11987 describes an insecure direct object reference vulnerability in the Dokan WooCommerce Multivendor Marketplace plugin for WordPress. The flaw exists in the handling of the 'id' parameter, which lacks proper validation to ensure the requesting user owns the referenced product. Permission callbacks verify only generic vendor capabilities ('dokan_view_product_menu' / 'dokandar'), which all vendors possess, allowing authenticated users with subscriber-level access or above to read any vendor's products, including unpublished and pending items. This leads to unauthorized disclosure of product information across vendor accounts.

The vulnerability allows authenticated users with subscriber-level or higher privileges to access product information belonging to other vendors without authorization. This includes sensitive data such as product names, prices, SKUs, and descriptions, even for unpublished draft and pending listings. There is no indication of impact on integrity or availability, only confidentiality is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for updates from the vendor. Avoid granting unnecessary vendor capabilities to users. Do not rely solely on generic vendor capability checks for authorization.