CVE-2026-12077 describes a time-based SQL Injection vulnerability in the Dokan Pro WordPress plugin affecting all versions up to 5.0.4. The issue arises from improper neutralization of special elements in SQL commands (CWE-89) specifically via the 'latitude' and 'longitude' parameters. Because these parameters are not properly escaped or prepared, unauthenticated attackers can append malicious SQL queries to extract sensitive data from the backend database. The vulnerability is remotely exploitable without authentication and requires low attack complexity.

Successful exploitation allows an unauthenticated attacker to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability impacts confidentiality but does not affect integrity or availability according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable parameters if possible, or apply web application firewall (WAF) rules to detect and block SQL injection attempts targeting 'latitude' and 'longitude' parameters.