Description
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2026-06-25
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Dokan Pro plugin for WordPress contains a time‑based SQL injection flaw that is triggered by an unsanitized ’orderby’ parameter in all versions up to 5.0.4. Authenticated users who hold a Subscriber role or higher can append arbitrary SQL code to the query, enabling extraction of sensitive database contents. The weakness is a classic injection problem (CWE‑89) caused by insufficient escaping and lack of prepared statements.

Affected Systems

This vulnerability affects the WeDevs Dokan Pro WordPress plugin, versions 5.0.4 and earlier.

Risk and Exploitability

With a CVSS score of 6.5 the flaw falls into the Moderate severity range. The EPSS score is not available, making it unclear how frequently attackers are attempting to exploit it, and the issue is not listed in the CISA KEV catalog. The attack requires valid WordPress credentials with Subscriber‑level permissions (or higher) and depends on the plugin’s handling of the orderby parameter; once authenticated, an attacker can use the injection to read database data.

Generated by OpenCVE AI on June 25, 2026 at 04:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Dokan Pro to version 5.0.5 or newer, which removes the unsanitized orderby logic.
  • If an immediate patch cannot be applied, reduce the privileges of Subscriber‑level users or temporarily revoke those roles to prevent authenticated exploitation.
  • After updating or adjusting privileges, monitor the WordPress database and logs for anomalous SQL queries or unauthorized data access attempts.

Generated by OpenCVE AI on June 25, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 26 Jun 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 25 Jun 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Wedevs
Wedevs dokan Pro
Wordpress
Wordpress wordpress
Vendors & Products Wedevs
Wedevs dokan Pro
Wordpress
Wordpress wordpress

Thu, 25 Jun 2026 03:45:00 +0000

Type Values Removed Values Added
Description The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Title Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Wedevs Dokan Pro
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-06-25T23:18:52.368Z

Reserved: 2026-06-12T12:42:00.720Z

Link: CVE-2026-12079

cve-icon Vulnrichment

Updated: 2026-06-25T23:18:46.283Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-25T08:45:05Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')