CVE-2026-12077
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk19th percentile — higher than 19% of all known CVEs
Summary
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'latitude' and 'longitude' parameters in all versions up to and including 5.0.4 due to insufficient escaping and lack of proper query preparation.
Risk Assessment
Unauthenticated attackers can append additional SQL queries to existing ones, allowing extraction of sensitive information from the database, such as user credentials or personal data.
Recommendation
Immediately update the Dokan Pro plugin to a version newer than 5.0.4 and deploy Web Application Firewalls (WAF) to block malicious SQL queries.
Original NVD description (English source)
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.