Atomic Edge analysis of CVE-2026-12077 (metadata-based): This vulnerability is an unauthenticated time-based SQL Injection in the Dokan Pro plugin for WordPress, affecting versions up to and including 5.0.4. The flaw exists in the handling of ‘latitude’ and ‘longitude’ parameters, allowing unauthenticated attackers to extract sensitive database information. The CVSS score is 7.5 (High), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting the high confidentiality impact and no requirement for authentication or user interaction.
Root Cause: Based on the CWE-89 classification and description, Atomic Edge analysis infers that the plugin directly incorporates user-supplied ‘latitude’ and ‘longitude’ parameters into an SQL query without proper escaping or parameterized queries (prepared statements). The vulnerability is classified as time-based SQL injection, meaning the attacker manipulates SQL ‘SLEEP()’ or similar timing functions to infer database structure or content by observing response delays. This is a confirmed type from the CVE description, but without source code access, the exact query construction remains inferred. The lack of nonce verification or capability checks on the AJAX endpoint handling these parameters is also inferred, as the vulnerability is exploitable by unauthenticated users.
Exploitation: An unauthenticated attacker can exploit this vulnerability by sending a crafted request to an AJAX endpoint (likely /wp-admin/admin-ajax.php) with an action parameter specific to Dokan Pro that processes geographic data. The attacker injects SQL commands through the ‘latitude’ and ‘longitude’ parameters, using time-based payloads such as: ‘ OR IF((SELECT SUBSTRING(user_pass,1,1) FROM wp_users LIMIT 1)=’a’,SLEEP(5),0) — -‘. The attack vector is network-based (AV:N), requires no privileges (PR:N), and no user interaction (UI:N). Atomic Edge research determines the exploitation is straightforward, as the parameters are directly accepted from the request without sanitization.
Remediation: The fix implemented in version 5.0.5 likely replaces direct string concatenation in SQL queries with parameterized queries using $wpdb->prepare() or similar methods. The plugin should escape user input with esc_sql() or use $wpdb->prepare() with %d or %f placeholders for numeric parameters like latitude and longitude. Additionally, the plugin should add nonce verification and capability checks to the AJAX handler to prevent unauthenticated access. Atomic Edge analysis recommends developers always use prepared statements for any database query involving external input and validate that numeric parameters are actually numeric before use.
Impact: Successful exploitation allows an unauthenticated attacker to extract any data from the WordPress database, including user password hashes, email addresses, session tokens, and potentially sensitive configuration data. While the CVSS impact scores only confidentiality (C:H), extracted password hashes can often be cracked offline, leading to privilege escalation and full site compromise. The attack is time-based, so extraction is slower but still practical. The vulnerability does not allow direct data modification (I:N) or availability impact (A:N), but the confidentiality breach is severe enough to warrant immediate patching.
