Dokan Pro CVE-2026-65494

Exploitation requires an authenticated low-privilege WordPress account at Subscriber level or above (CVSS PR:L), obtainable through the site's registration flow - which on marketplace deployments is frequently open by default, lowering the barrier. Beyond a valid account, the attacker needs network access to the vulnerable Dokan Pro request handler and no user interaction (UI:N). Limiting factors: the high attack complexity (AC:H) indicates the injection is not trivially triggerable and likely demands crafted or blind payloads, and sites that disable open registration or require manual account approval remove the prerequisite foothold entirely. The specific vulnerable parameter/endpoint is not disclosed in the provided data and should be confirmed from the Patchstack advisory.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L yields 7.1 (High): network-reachable and requiring no user interaction, but with high attack complexity and low-privilege authentication (PR:L). The PR:L requirement is meaningful - on many WordPress marketplaces registration is open, so obtaining a Subscriber account is often trivial, which partially offsets the AC:H rating. Impact is weighted toward confidentiality (C:H) with a scope change (S:C), consistent with reading data outside the plugin's authorization context; integrity is unaffected (I:N) and availability impact is limited (A:L). EPSS and KEV data were not provided in the intelligence set, so exploitation probability cannot be quantified and there is no evidence of active exploitation. No POC was supplied. Overall this is a credible priority for any live multivendor Dokan Pro store with open registration, but the absence of KEV/EPSS/POC signals suggests it is not yet under mass exploitation - patch on a normal-to-expedited cycle.

An attacker registers a free Subscriber (or vendor) account on a Dokan Pro-powered marketplace with open registration, then sends crafted requests to the vulnerable plugin endpoint embedding SQL payloads in a parameter. Exploiting the injection over the network (AV:N) without any user interaction, they enumerate and exfiltrate database contents beyond their authorization scope, including customer records and WordPress user password hashes. No public POC was provided, and the high attack complexity (AC:H) implies the payload requires some tailoring, such as a blind/time-based technique.