# CVE-2026-65494: Dokan Dokan Pro SQL injection in Subscriber role

Source: https://junglewise.ai/threats/cve-2026-65494-dokan-dokan-pro-sql-injection-in-subscriber-role  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65494 · Severity: high · CVSS 7.1 · Published 2026-07-23

Dokan Pro, a popular multi-vendor marketplace solution for WordPress, contains a security flaw that allows users with basic 'Subscriber' accounts to perform unauthorized database operations. An attacker could exploit this to steal sensitive information from the website's database, potentially compromising customer data or site configuration. While the vulnerability requires specific conditions to exploit, it poses a significant risk to the confidentiality of the marketplace's data.

Technologies: [weDevs Dokan Pro](https://junglewise.ai/threats/technologies/dokan-pro). Vendors: [weDevs](https://junglewise.ai/threats/vendors/wedevs).

## Quick answers

**Is CVE-2026-65494 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65494 being exploited in the wild.

**How severe is CVE-2026-65494?** High severity, with a CVSS score of 7.1, published 23 July 2026.

**Which products and versions are affected?** weDevs Dokan Pro <= 5.0.2.

**Is there a fix for CVE-2026-65494?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65494 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65494?** Check whether you run weDevs Dokan Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the Dokan Pro plugin for WordPress (versions <= 5.0.2) due to improper neutralization of special elements used in SQL commands (CWE-89). The flaw is accessible to authenticated users with 'Subscriber' privileges. Although the attack complexity is rated as high, a successful exploit allows a remote attacker to execute arbitrary SQL queries against the backend database. This can lead to the extraction of sensitive information or a partial loss of availability. At the time of the advisory, no official patch was available, and users are advised to use mitigation tools like Patchstack.

## Affected products

- Dokan Dokan Pro <= 5.0.2

## Timeline

- 2026-06-07: other: Reported by Expatch
- 2026-07-23: disclosed: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-2-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-2-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [Dokan Multivendor Dokan Pro broken access control](https://junglewise.ai/threats/cve-2026-65495-dokan-multivendor-dokan-pro-broken-access-control)
- [Dokan Dokan Pro PHP Object Injection](https://junglewise.ai/threats/cve-2026-65493-dokan-dokan-pro-php-object-injection)
- [weDevs Dokan Pro unauthenticated XSS](https://junglewise.ai/threats/cve-2026-65492-wedevs-dokan-pro-unauthenticated-xss)
- [weDevs Dokan Pro privilege escalation in update_capabilities REST Endpoint](https://junglewise.ai/threats/cve-2026-12224-wedevs-dokan-pro-privilege-escalation-in-update-capabilities-rest)
- [Dokan Multivendor Plugin Dokan Pro unauthenticated privilege escalation](https://junglewise.ai/threats/cve-2026-56033-dokan-multivendor-plugin-dokan-pro-unauthenticated-privilege)