CVE-2026-65494 HIGH

CVE-2026-65494: WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability

Vendor Dokan
Product Dokan Pro
Weakness CWE-89 · SQLi
Published July 23, 2026
Last update July 23, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Dokan Pro versions up to 5.0.2 contain a SQL injection vulnerability in a database query that requires low-level authentication to exploit. An attacker with a user account can craft malicious input to read or modify database contents. The vulnerability affects multiple site functions due to scope change, and also causes partial service disruption.

What an attacker can do

03Attacker Capabilities

Read or modify database records by injecting SQL commands into a query parameter.

Potential impact on your site

04Site Impact

Unauthorized access to sensitive data and potential data modification; some site functions may become unavailable.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

July 23, 2026 CVE published
July 23, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57756 WordPress nicen-localize-image plugin <= 1.4.9 - SQL Injection vulnerability CVE-2026-39581 WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.4 - SQL Injection vulnerability CVE-2026-8441 WP Review Slider Pro <= 12.7.2 - Unauthenticated SQL Injection via 'notinstring' Parameter CVE-2026-40762 WordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerability CVE-2026-57683 WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability