What is the CVSS score of CVE-2026-65494?

CVE-2026-65494 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Dokan Pro are affected by CVE-2026-65494?

Dokan Pro marketplace software (versions 5.0.2 and earlier) contains a vulnerability allowing lower-level user accounts to access confidential data across the entire WordPress marketplace, including…

How to fix or mitigate CVE-2026-65494?

Within 24 hours, inventory all WordPress installations using Dokan Pro and determine if versions 5.0.2 or earlier are deployed; simultaneously audit database access logs for suspicious queries or data extraction patterns from low-privilege accounts. Within 7 days, deploy compensating controls including database-level privilege restrictions on the WordPress database user, web application firewall rules blocking SQL injection patterns in Dokan Pro input, and optional disabling of Subscriber-level marketplace features in plugin settings. Within 30 days, monitor Patchstack and Dokan Pro vendor security channels for emergency patches; upgrade to the first patched version when released. No vendor-released patch identified at time of analysis.

Dokan Pro CVE-2026-65494

EUVD-2026-48105 HIGH

SQL Injection (CWE-89)

2026-07-23 Patchstack

GHSA-vrgp-j4x4-3mqv

WordPress SQLi Dokan Wordpress Plugin Dokan Pro

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Network SQLi reachable by any low-privilege Subscriber (PR:L), blind/complex injection (AC:H); scope change and cross-table read give S:C and C:H with no integrity impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:31 vuln.today

CVE Published

Jul 23, 2026 - 11:19 cve.org

HIGH 7.1

DescriptionCVE.org

Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.

AnalysisAI

Authenticated SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (versions <= 5.0.2) allows a low-privileged Subscriber-level user to inject malicious SQL into backend database queries, enabling extraction of sensitive data across the WordPress store. Reported by Patchstack and rated CVSS 7.1, the scope-changed vector reflects that a compromised low-tier account can reach data beyond its own authorization boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Dokan Pro is the commercial extension of the widely used Dokan multivendor marketplace plugin for WordPress/WooCommerce, adding vendor storefronts, subscriptions, and reporting features. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaching a database query is concatenated without adequate parameterization or sanitization via WordPress's $wpdb prepared-statement API. The affected component is identified by CPE cpe:2.3:a:dokan:dokan_pro (all versions through 5.0.2). Because WordPress plugins share a single database with the core CMS, an injection point in a plugin query can expose core tables (e.g., wp_users, wp_usermeta) containing password hashes and session/auth data.

RemediationAI

Upgrade Dokan Pro to a version later than 5.0.2 (the next maintenance release above 5.0.2); the exact fixed version is not stated in the provided intelligence, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-2-sql-injection-vulnerability?_s_id=cve) and the WeDevs/Dokan changelog to confirm the patched build before deploying. Until patched, reduce exposure by disabling open self-registration or gating new Subscriber/vendor accounts behind manual approval to remove the low-privileged foothold the exploit needs (side effect: adds friction to legitimate vendor onboarding). Deploy a WAF or the Patchstack virtual patch with a rule targeting the vulnerable endpoint to block SQL metacharacters (side effect: possible false positives on legitimate store queries), and restrict or monitor access to the affected Dokan Pro request path. Because this is a data-confidentiality issue, also rotate WordPress secrets and, if compromise is suspected, force password resets since wp_users hashes may have been exposed.