CVE-2026-12079: Dokan Pro SQL Injection via orderby Parameter

Technical summary

CVE-2026-12079 is a time-based SQL injection flaw affecting Dokan Pro versions up to 5.0.4. The vulnerability exists because the 'orderby' parameter is not properly escaped or parameterized before being incorporated into SQL queries. An authenticated attacker (Subscriber role or higher) can exploit insufficient input validation to inject arbitrary SQL, allowing extraction of database contents that would normally be restricted from their access level.

Business impact

Organizations running Dokan Pro e-commerce storefronts face potential exposure of customer data, order information, and other database records that authenticated users should not access. Even though attackers must possess valid WordPress credentials, the Subscriber role is often assigned to customers during account registration, significantly broadening the attack surface. Data compromise could trigger regulatory notification obligations (GDPR, CCPA) and erode customer trust.

Affected systems

All installations of the Dokan Pro WordPress plugin up to and including version 5.0.4 are affected. Dokan Pro is a popular multivendor e-commerce solution that integrates with WooCommerce. The vulnerability applies to any WordPress site running this plugin version that allows user registration or has Subscriber-level users.

Exploitability

Exploitation requires valid WordPress credentials at the Subscriber level or above. The barrier to entry is low for attackers who can register an account on a Dokan Pro site, making this especially problematic for public-facing stores. The injection is time-based, meaning attackers must use timing analysis to extract data, which is more cumbersome than error-based injection but still reliably exploitable. No user interaction is required once an attacker has authenticated.

Remediation

Update Dokan Pro to a patched version beyond 5.0.4 as soon as it becomes available. Verify the patched version number in the official Dokan Pro release notes or security advisories. Until a patch is deployed, restrict Subscriber role creation, disable user registration on the WordPress site if feasible, or implement Web Application Firewall (WAF) rules to block suspicious 'orderby' parameter patterns. Review database access logs for signs of unusual query activity.

Patch guidance

Monitor the official Dokan Pro website and your WordPress admin dashboard for version updates. When a patched release is announced, follow the standard WordPress plugin update procedure: back up your WordPress database and files, test the update in a staging environment, then apply to production during a maintenance window. Verify that the update explicitly addresses this SQL injection issue before deploying. If an update is not yet available, contact Dokan Pro support directly for a timeline or interim security guidance.

Detection guidance

Examine web server logs and WordPress security logs for repeated requests containing encoded or obfuscated SQL syntax in the 'orderby' parameter (such as UNION, SELECT, WHERE keywords). Monitor database logs for unusual query patterns from application user accounts, particularly those associated with lower-privilege roles. Use WordPress security plugins to log and alert on suspicious REST API or admin requests. Implement rate limiting on endpoints that process the 'orderby' parameter to slow time-based injection attacks.

Why prioritize this

This vulnerability carries a CVSS 3.1 score of 6.5 (MEDIUM) with high confidentiality impact but no integrity or availability risk. Prioritize patching based on your store's user base size: sites that allow unrestricted Subscriber registration are at higher risk than closed-access or vendor-only platforms. The vulnerability does not exploit unauthenticated users or enable data modification, but the realistic attack surface (anyone can register as a Subscriber) warrants urgent patching within 30 days. It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, but publication may attract active exploitation.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects the requirement for authenticated access (PR:L), which reduces the overall severity compared to unauthenticated SQL injection. However, the high confidentiality impact (C:H) and network accessibility (AV:N) of the flaw elevate it to MEDIUM severity. The score appropriately captures that a low-privilege but obtainable attacker role creates meaningful data exposure risk without enabling system compromise or modification.

Frequently asked questions