CVE-2026-12079: Dokan Pro WordPress Plugin SQLi Vulnerability

CVE-2026-12079 Overview

The Dokan Pro plugin for WordPress contains a time-based SQL Injection vulnerability in the orderby parameter. The flaw affects all versions up to and including 5.0.4. The plugin fails to properly escape user-supplied input and does not adequately prepare the underlying SQL query. Authenticated attackers with Subscriber-level access or higher can append additional SQL queries to existing database operations. Successful exploitation allows extraction of sensitive information from the WordPress database, including credentials, session tokens, and customer data. The vulnerability falls under [CWE-89] for Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers with minimal Subscriber privileges can exfiltrate sensitive database contents through time-based SQL injection on the orderby parameter.

Affected Products

Dokan Pro plugin for WordPress versions up to and including 5.0.4
WordPress sites running Dokan Pro multivendor marketplace functionality
Any e-commerce deployment relying on vulnerable Dokan Pro releases

Discovery Timeline

2026-06-25 - CVE CVE-2026-12079 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-12079

Vulnerability Analysis

The vulnerability resides in how Dokan Pro processes the orderby HTTP parameter before incorporating it into SQL statements. The plugin accepts the parameter directly from authenticated user requests without applying sufficient escaping or input sanitization. The constructed SQL query does not use prepared statements with bound parameters for this input. As a result, an authenticated attacker can inject SQL fragments that execute alongside the intended query. The injection is time-based, meaning attackers infer data character-by-character by observing query execution delays triggered by functions such as SLEEP() or BENCHMARK(). Because Subscriber accounts can self-register on many WordPress sites, the practical barrier to exploitation is low.

Root Cause

The root cause is twofold. First, the orderby parameter is not validated against an allowlist of acceptable column names. Second, the plugin concatenates the parameter into the SQL string instead of using $wpdb->prepare() placeholders. These two failures combine to allow arbitrary SQL syntax in the ORDER BY clause, where standard parameter binding is not applicable and strict allowlisting is the only safe approach.

Attack Vector

Exploitation requires network access to the WordPress site and authenticated Subscriber-level credentials. The attacker submits a crafted request containing SQL payloads in the orderby query parameter. The payload uses conditional time delays to perform blind data extraction. No user interaction beyond the attacker's own request is required. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-12079

Indicators of Compromise

HTTP requests containing SQL keywords such as SLEEP, BENCHMARK, CASE WHEN, or IF( in the orderby parameter
Database queries with unusually long execution times originating from Dokan Pro endpoints
Repeated authenticated requests from Subscriber accounts targeting Dokan vendor or product listing endpoints
Web server logs showing URL-encoded SQL syntax in orderby values

Detection Strategies

Inspect web application firewall logs for SQL syntax patterns within the orderby query string parameter
Correlate slow query logs from MySQL or MariaDB with corresponding HTTP requests to Dokan endpoints
Monitor authentication logs for newly created Subscriber accounts that immediately access Dokan Pro pages
Apply [CWE-89] SQL injection signatures to traffic targeting /wp-admin/admin-ajax.php and Dokan REST routes

Monitoring Recommendations

Enable WordPress query logging or use a database proxy to capture full SQL statements during investigations
Alert on outbound responses with anomalous latency tied to Dokan Pro request paths
Track Subscriber account creation rates and flag bursts that precede marketplace browsing activity
Review WordPress wp_users and wp_usermeta tables periodically for unauthorized access patterns

How to Mitigate CVE-2026-12079

Immediate Actions Required

Upgrade Dokan Pro to a version newer than 5.0.4 once the vendor releases a patched build
Restrict new user registration or require manual approval for Subscriber-level accounts on affected sites
Deploy or update web application firewall rules to block SQL injection patterns in the orderby parameter
Audit existing Subscriber accounts and revoke any suspicious or unused credentials

Patch Information

Review the Wordfence Vulnerability Report and the Dokan Official Website for the latest fixed release. Apply the patched version of Dokan Pro across all WordPress installations as soon as it becomes available. Until then, treat all versions through 5.0.4 as vulnerable.

Workarounds

Disable the Dokan Pro plugin temporarily if patching is not immediately feasible
Place the WordPress site behind a web application firewall with SQL injection signatures enabled
Implement server-level rules that reject requests containing SQL keywords in the orderby parameter
Reduce database account privileges used by WordPress to limit data accessible through injection

bash

# Example WAF rule pattern to block SQL syntax in orderby parameter
SecRule ARGS:orderby "@rx (?i)(sleep|benchmark|case\s+when|union\s+select|;|--)" \
    "id:1026120,phase:2,deny,status:403,msg:'CVE-2026-12079 SQLi attempt on orderby parameter'"