CVE-2026-11987 is an insecure direct object reference vulnerability in the Dokan WooCommerce Multivendor Marketplace plugin for WordPress. The vulnerability exists in all versions up to and including 5.0.4 and is due to insufficient validation of the 'id' parameter, which is user-controlled. Permission callbacks for relevant API endpoints check only generic vendor capabilities ('dokan_view_product_menu' / 'dokandar') without verifying that the authenticated user owns the requested product or author ID. This allows authenticated attackers with subscriber-level access or higher to read any vendor's products, including unpublished and pending listings, exposing sensitive product information.

An attacker with subscriber-level or higher privileges can access product data belonging to other vendors, including unpublished drafts and pending listings. This leads to unauthorized disclosure of product names, prices, SKUs, and descriptions. The vulnerability does not affect data integrity or availability but compromises confidentiality of vendor product information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for updates from the vendor. Avoid granting unnecessary vendor capabilities to users. Follow the vendor's guidance once a patch or update is released.