Executive brief
Dokan Pro is a popular WordPress plugin used to create multi-vendor marketplaces similar to Amazon or Etsy. A security flaw in the plugin allows unauthenticated attackers to perform SQL injection attacks, which could lead to the unauthorized extraction of sensitive information from the website's database. This could include customer data, vendor details, or other proprietary business information stored on the platform.
Technical details
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4. The root cause is insufficient escaping of user-supplied parameters and a lack of proper SQL query preparation using WordPress's wpdb::prepare() or similar methods. This vulnerability allows unauthenticated remote attackers to append malicious SQL commands to existing queries. By observing the time delay in server responses, an attacker can systematically extract sensitive information from the database. The vulnerability is tracked as CWE-89.
Affected products
- weDevs Dokan Pro <= 5.0.4
Timeline
- 2026-06-25: advisory: Advisory published by Wordfence and NVD