The Dokan Pro plugin for WordPress contains a time‑based SQL injection flaw that is triggered by an unsanitized ’orderby’ parameter in all versions up to 5.0.4. Authenticated users who hold a Subscriber role or higher can append arbitrary SQL code to the query, enabling extraction of sensitive database contents. The weakness is a classic injection problem (CWE‑89) caused by insufficient escaping and lack of prepared statements.

This vulnerability affects the WeDevs Dokan Pro WordPress plugin, versions 5.0.4 and earlier.

With a CVSS score of 6.5 the flaw falls into the Moderate severity range. The EPSS score is not available, making it unclear how frequently attackers are attempting to exploit it, and the issue is not listed in the CISA KEV catalog. The attack requires valid WordPress credentials with Subscriber‑level permissions (or higher) and depends on the plugin’s handling of the orderby parameter; once authenticated, an attacker can use the injection to read database data.