CVE-2026-12079
Description
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Summary dbcve.org
The Dokan Pro WordPress plugin fails to properly sanitize and escape the 'orderby' parameter before using it in SQL queries, combined with insufficient use of prepared statements. This allows authenticated users with Subscriber-level access or higher to inject arbitrary SQL commands, specifically time-based blind SQL injection that can be used to extract sensitive data from the database.
Mitigation
Update Dokan Pro to the latest version which should contain patched code, or implement proper escaping of the orderby parameter using WordPress's $wpdb->prepare() method with strict allowlist validation for permitted sorting columns.