CVE-2026-12077
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'latitude' and 'longitude' parameters in all versions up to and including 5.0.4 due to insufficient escaping and lack of proper query preparation.
Risk Assessment
Unauthenticated attackers can append additional SQL queries to existing ones, allowing extraction of sensitive information from the database, such as user credentials or personal data.
Recommendation
Immediately update the Dokan Pro plugin to a version newer than 5.0.4 and deploy Web Application Firewalls (WAF) to block malicious SQL queries.
Other vulnerabilities in Dokan Pro
See all- CVE-2026-65495High
The Dokan Pro plugin versions up to 5.0.3 contain an unauthenticated Broken Access Control vulnerability. An attacker can gain unauthorized access to functions or data.
- CVE-2026-65494High
The Dokan Pro plugin versions up to 5.0.2 contain an SQL Injection vulnerability exploitable by a subscriber. An attacker with subscriber privileges can manipulate database queries.
- CVE-2026-65493High
The Dokan Pro plugin version 5.0.2 and earlier allows a subscriber-level PHP object injection. An attacker with subscriber role can submit malicious data that gets deserialized, leading to remote code execution.
- CVE-2026-65492High
The Dokan Pro plugin version 5.0.0 and earlier has an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious JavaScript into the page.
- CVE-2026-12224High
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via the update_capabilities REST Endpoint in all versions up to and including 5.0.4. The lack of allowlist validation allows authenticated attackers with Vendor-level access or higher, when the Vendor Staff module is enabled, to grant arbitrary WordPress capabilities, including administrator, to vendor_staff accounts, leading to full site takeover.
Original NVD description (English source)
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.