CVE-2026-12077: Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12077?
CVE-2026-12077 has a severity rating of high, with a score of 7.5.
How do I fix CVE-2026-12077?
To fix CVE-2026-12077, update the Dokan Pro plugin to version 5.0.5 or later to mitigate the SQL Injection vulnerability.
What type of vulnerability is CVE-2026-12077?
CVE-2026-12077 is classified as an SQL Injection vulnerability.
What are the affected versions in CVE-2026-12077?
CVE-2026-12077 affects all versions of the Dokan Pro plugin up to and including version 5.0.4.
What parameters are exploited in CVE-2026-12077?
CVE-2026-12077 can be exploited via the 'latitude' and 'longitude' parameters.