WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection
CVE-2023-26525

7.1HIGH

Key Information:

Vendor
WordPress
Status
Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
Vendor
CVE Published:
20 December 2023

Summary

The vulnerability in weDevs Dokan – a leading WooCommerce multivendor marketplace solution – arises from the inadequate sanitization of user-supplied input within SQL commands. This SQL Injection flaw allows attackers to execute arbitrary SQL code, which can compromise the integrity of the database and expose sensitive data. Versions up to and including 3.7.12 are affected. It is crucial for website administrators using this plugin to apply the latest security updates and implement best practices to protect against potential exploitation.

Affected Version(s)

Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 3.7.12

References

https://patchstack.com/database/vulnerability/dokan-lite/...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.