CVE-2026-12077

Name of the Vulnerable Software and Affected Versions Dokan Pro versions prior to 5.0.5

Description The Dokan Pro plugin for WordPress contains a time-based SQL Injection flaw. This issue occurs because user-supplied parameters are not sufficiently escaped and the SQL query is not properly prepared. Unauthenticated attackers can exploit this by appending additional SQL queries to existing ones to extract sensitive information from the database via the latitude and longitude parameters.

Recommendations Update Dokan Pro to a version newer than 5.0.4. As a temporary mitigation, restrict or filter the use of the latitude and longitude parameters.