Vulnerability record · CVE-2024-3922 · published 13 June 2024
CVE-2024-3922: Dokan Pro WordPress plugin unauthenticated SQL injection via code parameter
Dokan · Dokan
Dokan Pro for WordPress, in versions up to and including 3.10.3, fails to escape the 'code' parameter and does not properly prepare its SQL query, allowing SQL injection. Because the flaw is reachable without authentication, any remote attacker can inject SQL into existing queries and read sensitive data from the site's database.
Description
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-reachable SQL injection with CVSS 9.8 and very high EPSS makes this an urgent patch-first issue.
What it is
Dokan Pro for WordPress, in versions up to and including 3.10.3, fails to escape the 'code' parameter and does not properly prepare its SQL query, allowing SQL injection. Because the flaw is reachable without authentication, any remote attacker can inject SQL into existing queries and read sensitive data from the site's database.
Impact
An attacker can extract sensitive information from the WordPress database, including user credentials, order and customer data, and other stored secrets. The CVSS vector also rates high integrity and availability impact, so data modification or disruption is possible.
Attack surface
Reachable over the network through the plugin's handling of the 'code' parameter; the CVSS vector shows no privileges and no user interaction required, so it is unauthenticated and remotely triggerable.
Exploitation
Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is 0.52915 (98.9th percentile), indicating a high modeled likelihood of exploitation.
What to do
- Update Dokan Pro to a version later than 3.10.3, per the vendor changelog.
- If patching is not immediately possible, disable the Dokan Pro plugin or restrict access to the affected endpoint.
- Deploy a WAF rule blocking SQL injection patterns targeting the 'code' parameter.
- Rotate database and WordPress credentials if compromise is suspected.
- Review database and web logs for anomalous queries or requests containing SQL syntax in the 'code' parameter.
Detection
- Search web server and WAF logs for requests with SQL keywords or comment sequences in the 'code' parameter.
- Monitor database query logs for unexpected UNION, SELECT, or stacked query patterns from the WordPress application.
- Alert on outbound or unusual database reads of user and order tables following plugin endpoint access.
- Correlate requests to Dokan Pro endpoints with subsequent authentication or data exfiltration activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://dokan.co/docs/wordpress/changelog/ | Release Notes |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/d9de41de-f2f7-4b16-8ec9-d30bbd3d8786?source=cve | Third Party Advisory |
| https://dokan.co/docs/wordpress/changelog/ | Release Notes |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/d9de41de-f2f7-4b16-8ec9-d30bbd3d8786?source=cve | Third Party Advisory |
Track CVE-2024-3922 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-3922), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
