CVE-2024-3922

Deeper analysis

The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to and including 3.10.3. The issue stems from insufficient escaping of user-supplied input combined with a lack of prepared statements on an existing SQL query, as reflected in its CWE-89 classification and maximum CVSS 3.1 score of 10.0.

Unauthenticated attackers can supply crafted input to the affected parameter and append arbitrary SQL statements to existing queries. Successful exploitation enables extraction of sensitive database contents and carries the potential for broader impacts on confidentiality, integrity, and availability given the critical severity rating.

Public references point to the vendor changelog and Wordfence threat intelligence entries for remediation guidance, which typically involve updating to a patched release beyond 3.10.3. The CVE carries an EPSS score of 0.8966, indicating substantial exploitation likelihood.