EUVD-2026-39166
GHSA-8r4g-qxjq-qwgc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable parameter (AV:N/PR:N/UI:N), straightforward blind injection (AC:L), read-only data disclosure so C:H but I:N/A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Articles & Coverage 1
AnalysisAI
SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (all versions ≤ 5.0.4) lets unauthenticated remote attackers inject SQL through the 'latitude' and 'longitude' request parameters, enabling extraction of arbitrary database contents such as user credentials, API keys, and order data. The flaw is time-based (blind) and requires no authentication or user interaction, but no public exploit code or active exploitation has been identified at time of analysis. No EPSS or CISA KEV signal was provided in the source data.
Technical ContextAI
Dokan Pro is the commercial extension of the Dokan multivendor marketplace plugin for WordPress (vendor wedevs/weDevs), used to run e-commerce sites where many sellers operate storefronts; the 'latitude'/'longitude' parameters relate to vendor/store geolocation features. The vulnerability is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The root cause, per the description, is that user-supplied latitude/longitude values are insufficiently escaped and concatenated into an existing SQL query without proper parameterization (e.g. WordPress $wpdb->prepare()), allowing attacker-controlled input to break out of the intended query context and append additional SQL. The affected CPE is cpe:2.3:a:wedevs:dokan_pro:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade Dokan Pro to a version later than 5.0.4 as soon as the vendor's patched release is available; the input data does not name an exact fixed version, so No vendor-released patch version is independently confirmed at time of analysis - consult the vendor advisory at https://dokan.co/ and the Wordfence record at https://www.wordfence.com/threat-intel/vulnerabilities/id/6565e345-3374-43d9-9789-f0d9138dc3e8?source=cve to obtain the corrected build. Until patched, deploy a WAF or WordPress firewall (such as Wordfence) with rules to block SQL metacharacters in the 'latitude' and 'longitude' parameters, which may produce false positives on legitimate decimal coordinate input and should be tuned. As a stronger interim control, restrict or disable the vendor geolocation/store-location feature that consumes these parameters if your deployment does not require it, accepting loss of map/location functionality for sellers. Ensure database accounts used by WordPress have least-privilege grants to limit the scope of any data disclosure.
Privilege escalation in the Dokan Pro WooCommerce multivendor plugin for WordPress (all versions through 5.0.4) allows a
Broken access control in Dokan Pro (the premium extension of the Dokan multivendor marketplace plugin for WordPress) thr
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding
Authenticated SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (versions <= 5.0.2) allows a low-p
Stored/reflected Cross-Site Scripting in the Dokan Pro WordPress multivendor marketplace plugin (versions up to and incl
Time-based blind SQL injection in the Dokan Pro WordPress plugin allows network-accessible authenticated attackers with
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today