Dokan Pro EUVD-2026-39165

Exploitation requires the attacker to hold a valid WordPress account at Subscriber level or above on the target site - this is the lowest non-anonymous role in WordPress and is commonly auto-granted upon public registration on marketplace sites. The vulnerable parameter is 'orderby', accessible via network HTTP requests to the affected Dokan Pro endpoint; no special server configuration beyond running an unpatched version (≤5.0.4) of the plugin is required. What limits exploitation: the attacker must have an authenticated session (PR:L per CVSS), the WooCommerce/Dokan Pro plugin must be active and publicly accessible, and blind time-based extraction is slow and may be detected by anomaly monitoring on response time patterns. There is no requirement for admin access, code execution preconditions, or non-default configuration beyond the plugin being installed and enabled.

The NVD CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects a medium-severity but high-confidentiality-impact issue. The network attack vector and low attack complexity mean exploitation is straightforward for any authenticated subscriber. The primary limiting factor is PR:L - an attacker must hold at least a Subscriber-level WordPress account, which on many marketplace sites is freely self-registerable, effectively reducing this to a near-unauthenticated risk posture in real-world deployments. Integrity and availability are unaffected (I:N/A:N), meaning this is a pure data exfiltration vector. No EPSS data was provided in the source intelligence, and neither KEV listing nor public POC code has been identified, suggesting exploitation remains opportunistic rather than widespread at time of analysis. However, the low bar for access and the sensitive nature of a multivendor marketplace database (customer PII, order history, payment metadata) makes this a genuine remediation priority for affected sites. The risk is not inflated by CVSS - it is consistent across all available signals.

An attacker registers a free Subscriber account on a Dokan Pro-powered WooCommerce marketplace site, then sends crafted HTTP requests to the vulnerable endpoint with a malicious 'orderby' parameter containing time-based SQL payloads (e.g., appending ORDER BY SLEEP(5) constructs). By measuring response latency, the attacker iteratively extracts database contents - including WordPress user table credentials, customer PII, and WooCommerce order data - without triggering visible errors. No public exploit code has been identified, but the technique is well-documented for time-based blind SQLi and does not require advanced skill.