CVE-2026-12077: Dokan Pro SQL Injection Vulnerability – Unauthenticated Data Breach Risk

Technical summary

CVE-2026-12077 is a time-based SQL injection vulnerability in Dokan Pro affecting all versions through 5.0.4. The flaw exists in insufficient escaping of the 'latitude' and 'longitude' parameters combined with improper SQL query preparation. An unauthenticated attacker can bypass input validation to append arbitrary SQL statements to existing queries, enabling data exfiltration from the WordPress database. The vulnerability is classified as CWE-89 (SQL Injection) and carries a CVSS v3.1 score of 7.5 (HIGH) with a network attack vector requiring no privileges or user interaction.

Business impact

Organizations running Dokan Pro-based marketplace platforms face direct risk of confidential data theft, including customer information, transaction records, and database credentials. While the vulnerability does not allow modification or deletion of data (integrity and availability are not impacted per the CVSS vector), the high confidentiality impact means sensitive business intelligence, personal data, and authentication tokens could be exposed. For multi-vendor platforms, this threatens customer trust and may trigger regulatory compliance violations (GDPR, CCPA, etc.). The lack of authentication requirements means any internet-connected instance is immediately exploitable.

Affected systems

Dokan Pro plugin versions up to and including 5.0.4 are vulnerable. This affects WordPress installations that use Dokan Pro for marketplace functionality. The vulnerability is unauthenticated, making any publicly accessible WordPress site running a vulnerable version a potential target. Verify your installed version in wp-content/plugins/dokan-pro/ or check the 'Plugins' admin panel in WordPress. Note: vendor product data was not available in the disclosure; verify your specific Dokan Pro installation version against the official plugin repository.

Exploitability

This is a practical, exploitable vulnerability requiring only network access and HTTP capability—no authentication, no special privileges, no user interaction, and no complex client-side exploitation. Attackers can use time-based blind SQL injection techniques to infer database structure and contents through response timing differences. Publicly available SQL injection testing tools and methodologies apply directly. The absence of KEV (Known Exploited Vulnerability) designation as of the data provided does not reduce the intrinsic exploitability; this is a straightforward injection flaw that security researchers and threat actors can weaponize rapidly.

Remediation

Immediately update Dokan Pro to a version newer than 5.0.4 that includes the security patch. This is the primary remediation. As an interim mitigation, restrict direct internet access to your WordPress installation via Web Application Firewall (WAF) rules that block requests containing SQL keywords or suspicious characters in latitude/longitude parameters. Additionally, implement database-level access controls to limit the database user permissions WordPress uses—principle of least privilege reduces damage from successful injection. Monitor database logs for unusual query patterns.

Patch guidance

Patch availability depends on vendor release cadence; check the official Dokan Pro changelog and your WordPress plugin dashboard for updates newer than 5.0.4. WordPress site administrators should enable automatic plugin updates if permitted by their environment, or manually apply patches immediately upon availability. Test patches in a staging environment first to ensure compatibility with other marketplace extensions and custom configurations. Verify the patched version by reviewing the plugin source code or changelog to confirm the latitude and longitude parameters are now properly escaped and prepared.

Detection guidance

Monitor web server and WordPress access logs for requests containing SQL keywords (UNION, SELECT, WHERE, OR, etc.) in latitude or longitude parameters, particularly those with time-delay functions (SLEEP, BENCHMARK). Look for patterns of multiple similar requests with incrementally varying payload lengths—a hallmark of blind SQL injection reconnaissance. Enable WordPress security logging plugins (e.g., Wordfence) to capture plugin-level activity and failed database queries. Database query logs may show unusual SELECT statements targeting user, option, or postmeta tables when originating from web requests. Implement rate-limiting on the endpoints that accept these parameters.

Why prioritize this

HIGH severity, network-exploitable SQL injection with no authentication barrier makes this a critical priority. The vulnerability enables direct confidential data theft from a central database that likely contains customer PII, payment information, and business records. Time-based injection is moderately slower than boolean-based but still practical; skilled attackers can extract meaningful data within hours. For any Dokan Pro-based e-commerce platform, this should be patched before any other non-security feature work.

Risk score, explained

CVSS 7.5 reflects: (AV:N) network-accessible attack surface with minimal infrastructure; (AC:L) no special conditions or authentication required; (PR:N) completely unauthenticated; (UI:N) no user click or interaction needed; (S:U) impact stays within the vulnerable component; (C:H) high confidentiality loss through data extraction; (I:N) no integrity compromise; (A:N) no availability impact. The score is high—not critical—because attackers cannot modify or delete data, and the vulnerability does not compromise system availability. However, the confidentiality impact alone justifies urgent patching.

Frequently asked questions