CVE-2026-12077 describes a time-based SQL Injection vulnerability in the Dokan Pro WordPress plugin affecting all versions up to and including 5.0.4. The issue arises from improper neutralization of special elements in SQL commands, specifically through the 'latitude' and 'longitude' parameters. Insufficient escaping of user-supplied input and lack of prepared statements enable unauthenticated attackers to append malicious SQL queries to existing database queries. This can be exploited to extract sensitive information from the backend database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5, indicating high severity. No vendor advisory or patch information is currently available.

An unauthenticated attacker can exploit this vulnerability to perform time-based SQL Injection attacks, allowing them to extract sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. This can lead to data leakage and potential exposure of sensitive user or system information stored in the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable parameters if possible, or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'latitude' and 'longitude' parameters. Monitor vendor channels for updates and apply patches promptly once available.