CVE-2026-12077: Dokan Pro WordPress Plugin SQLi Vulnerability

CVE-2026-12077 Overview

CVE-2026-12077 is a time-based SQL Injection vulnerability affecting the Dokan Pro plugin for WordPress. The flaw exists in all versions up to and including 5.0.4. Attackers exploit the latitude and longitude parameters, which lack proper escaping and parameterization in the underlying SQL query. Unauthenticated attackers can append additional SQL statements to existing queries and extract sensitive data from the WordPress database. The issue is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, including user credentials and order data, from affected Dokan Pro WordPress marketplaces.

Affected Products

Dokan Pro plugin for WordPress, all versions up to and including 5.0.4
WordPress multi-vendor marketplace deployments using Dokan Pro
Sites exposing the vulnerable geolocation search endpoint to unauthenticated users

Discovery Timeline

2026-06-25 - CVE-2026-12077 published to the National Vulnerability Database
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-12077

Vulnerability Analysis

The vulnerability resides in Dokan Pro's location-based vendor search functionality. The plugin accepts user-supplied latitude and longitude parameters and concatenates them directly into a SQL query executed against the WordPress database. The plugin neither escapes the input nor uses prepared statements with bound parameters. As a result, an attacker can inject SQL syntax such as conditional SLEEP() payloads that introduce measurable delays in server responses. By observing response timing across many requests, an attacker reconstructs arbitrary data from tables such as wp_users and wp_usermeta. Because the endpoint accepts unauthenticated requests, exploitation requires no account on the target site.

Root Cause

The root cause is insufficient input sanitization and absent query preparation on the latitude and longitude request parameters. WordPress provides the $wpdb->prepare() method for parameterized queries, but the affected code path bypasses this safeguard. The numeric parameters are treated as trusted strings and inserted into the SQL statement verbatim.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends crafted HTTP requests to the Dokan Pro geolocation endpoint with SQL payloads embedded in the latitude or longitude parameters. Time-based blind techniques using SLEEP() or BENCHMARK() allow extraction of data one character at a time. Automated tools such as sqlmap can fully automate the extraction process against a vulnerable endpoint. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-12077

Indicators of Compromise

HTTP requests to Dokan Pro endpoints containing SQL keywords such as SLEEP, BENCHMARK, UNION SELECT, or IF( in the latitude or longitude parameters
Web server access logs showing repeated requests to the same Dokan endpoint with incrementing or single-character payload variations
Database slow query logs containing unusually long-running queries originating from Dokan plugin code paths
Unexpected outbound data flows from the WordPress host following anomalous request patterns

Detection Strategies

Inspect WordPress access logs for query parameters containing URL-encoded SQL syntax targeting latitude and longitude
Enable MySQL general or slow query logging and alert on queries containing SLEEP( originating from Dokan plugin execution
Deploy a Web Application Firewall (WAF) rule set that blocks SQL injection signatures on Dokan REST and AJAX endpoints
Correlate spikes in average response time on marketplace search endpoints with the source IP issuing the requests

Monitoring Recommendations

Monitor request rates and payload entropy against Dokan vendor search endpoints from individual source IPs
Track database CPU and query execution time baselines to identify time-based injection probing
Forward WordPress, PHP-FPM, and MySQL logs to a centralized SIEM for cross-source correlation
Alert on unauthenticated requests that produce repeated SQL syntax errors in PHP error logs

How to Mitigate CVE-2026-12077

Immediate Actions Required

Update the Dokan Pro plugin to a version later than 5.0.4 as soon as the vendor publishes a patched release
Apply WAF virtual patching rules that block SQL metacharacters in latitude and longitude request parameters
Audit the WordPress database for unauthorized account creation, modified user roles, and exfiltrated password hashes
Rotate WordPress administrator credentials and any API keys stored in wp_options if exploitation is suspected

Patch Information

Refer to the Dokan Official Website for the current patched release and changelog. The Wordfence Vulnerability Report tracks the fixed version once published by the vendor.

Workarounds

Disable Dokan Pro geolocation-based vendor search features until the plugin is updated
Restrict access to Dokan REST and AJAX endpoints to authenticated sessions using WordPress access control plugins
Deploy ModSecurity or equivalent WAF rules to reject requests where latitude or longitude parameters contain non-numeric content
Enforce strict input validation at the reverse proxy layer to allow only decimal numeric values for geographic coordinates

bash

# Example ModSecurity rule to block non-numeric latitude/longitude values
SecRule ARGS:latitude "!@rx ^-?[0-9]{1,3}(\.[0-9]+)?$" \
    "id:1012077,phase:2,deny,status:403,log,\
    msg:'CVE-2026-12077: Invalid latitude parameter'"

SecRule ARGS:longitude "!@rx ^-?[0-9]{1,3}(\.[0-9]+)?$" \
    "id:1012078,phase:2,deny,status:403,log,\
    msg:'CVE-2026-12077: Invalid longitude parameter'"