Atomic Edge analysis of CVE-2026-65494 (metadata-based):
This vulnerability is an authenticated SQL Injection in Dokan Pro for WordPress, affecting versions up to and including 5.0.2. The CWE-89 classification and the official description indicate that the plugin fails to properly escape a user-supplied parameter and fails to prepare the existing SQL query, allowing an authenticated user with subscriber-level access or higher to inject additional SQL commands. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores this at 6.5, reflecting a high confidentiality impact with no integrity or availability impact. Because no source code diff is available, the following analysis is inferred from the CWE, the CVSS vector, and the vulnerability description, not confirmed from plugin source code.
Atomic Edge research infers the root cause as a classic SQL injection pattern in a Dokan Pro database query. The vulnerable code likely uses a WordPress `$wpdb` method such as `get_results()`, `query()`, or `prepare()` improperly. The developer probably concatenated the user-controlled parameter directly into the SQL statement after only a weak escaping function, or passed it through `$wpdb->prepare()` that still allowed unsanitized input. The lack of sufficient preparation and inadequate escaping on the parameter allows an attacker to break out of the intended string or integer context and alter the query structure. This pattern is common in plugin modules that handle dynamic filtering, searching, or sorting for orders, products, or vendor-specific listings, and the access level of subscriber indicates the vulnerable endpoint is reachable by non-admin users.
To exploit this, an authenticated subscriber would send a crafted request to a Dokan Pro AJAX handler or REST API endpoint that accepts the vulnerable parameter. The attacker would use a standard SQL injection payload, such as appending `’ OR 1=1– -` or using a UNION SELECT to extract data, after determining the parameter’s value context. For example, if the vulnerable endpoint is an AJAX action like `dokan_pro_search_orders`, a request to `/wp-admin/admin-ajax.php` with `action=dokan_pro_search_orders` and a parameter like `order_id[]=` could contain a SQL injection payload. The attacker must include a valid WordPress nonce if the plugin requires it, and must authenticate as a subscriber, which they can do by registering a standard user account or compromising one. The absence of a nonce is not the vulnerability, but the attacker needs a valid session and capability to trigger the vulnerable AJAX action or REST route.
Remediation should focus on replacing all unsafe SQL queries with parameterized queries using `$wpdb->prepare()`. The plugin must ensure the user-supplied parameter is treated strictly as a data value and never concatenated directly into the SQL string. Additionally, the plugin should implement proper input validation and sanitization, such as casting numeric parameters to integers or using `sanitize_text_field()` where appropriate. Since no patched version is available for Dokan Pro 5.0.2, administrators should apply a virtual patch via a web application firewall and monitor for unauthorized subscriber accounts. Atomic Edge recommends denying access to any endpoint that processes user input until an official patch is released.
The impact is a full database disclosure for authenticated users with only subscriber-level privileges. An attacker can extract sensitive information including WordPress user hashes, session tokens, and any data stored in custom tables, such as Dokan vendor and order information. The CVSS confidentiality rating of High confirms that the primary risk is data breach. The attacker cannot directly modify or delete data based on the integrity rating of None, but SQL injection often enables further attacks, such as privilege escalation by inserting new admin users or reading files if database permissions allow. The low complexity and network attack vector make this a severe risk for any site using vulnerable Dokan Pro.
