The vulnerability is an SQL Injection flaw in Dokan Pro plugin versions 5.0.2 and earlier, where subscriber-submitted data is incorporated into database queries without proper sanitization. This weakness, identified as CWE-89, enables an attacker to inject and execute arbitrary SQL statements, potentially exposing or altering sensitive data stored in the WordPress database. The exact consequences depend on the attacker’s intent but could include data theft, modification, or deletion, thereby compromising the confidentiality and integrity of the site's information.

WordPress installations that have the Dokan Pro plugin installed at version 5.0.2 or earlier. The flaw is present regardless of the user’s role, as it is triggered through the subscriber interface of the plugin.

The CVSS score of 7.1 classifies the issue as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to submit crafted input through the plugin’s subscriber endpoints to inject malicious SQL. Although widespread exploitation is unlikely due to the low EPSS, the impact of a successful attack would be significant.