CVE-2024-3922

The vulnerability present in the Dokan Pro plugin for WordPress arises from a critical SQL Injection flaw that affects all versions up to and including 3.10.3. This vulnerability is primarily due to inadequate escaping of the 'code' parameter, which allows attackers to manipulate SQL queries executed by the application. When user-supplied input is not properly sanitized or prepared, it opens a pathway for malicious actors to inject arbitrary SQL commands. This can lead to unauthorized access to the database, where attackers can execute additional SQL queries that may reveal sensitive information, modify data, or even delete records.

Exploitation of this vulnerability can occur through various attack vectors. An unauthenticated attacker could craft a specially formed request that includes malicious SQL code within the 'code' parameter. For instance, by appending SQL commands to the legitimate request, an attacker could retrieve user credentials, payment information, or other confidential data stored in the database. This type of attack can be executed remotely, requiring no prior authentication, which significantly increases the risk as it allows for widespread exploitation across vulnerable installations of the plugin. Attackers may also employ automated tools to scan for vulnerable sites, making it easier to identify and exploit affected instances.

The real-world impact of this vulnerability can be severe, particularly for businesses that rely on the Dokan Pro plugin to facilitate e-commerce operations. The potential for data breaches could lead to significant financial losses, reputational damage, and legal repercussions due to non-compliance with data protection regulations. Organizations may face the costs associated with incident response, forensic investigations, and public relations efforts to mitigate the fallout from a data breach. Furthermore, the exposure of sensitive customer information can erode trust and lead to a loss of business, as customers may choose to engage with competitors perceived as more secure.

To detect and mitigate the risks associated with this SQL Injection vulnerability, organizations should implement a multi-faceted approach. Regular security assessments, including vulnerability scanning and penetration testing, can help identify instances of the vulnerable plugin in use. Additionally, maintaining an up-to-date inventory of all plugins and promptly applying security patches is crucial. Organizations should also consider employing Web Application Firewalls (WAFs) that can filter out malicious requests before they reach the application. Furthermore, developers should adopt secure coding practices, including the use of prepared statements and parameterized queries, to prevent SQL injection vulnerabilities in future code.

In conclusion, the SQL Injection vulnerability in the Dokan Pro plugin poses a significant threat to WordPress installations, particularly those involved in e-commerce. The ease of exploitation combined with the potential for severe consequences underscores the importance of proactive security measures. By prioritizing detection and mitigation strategies, organizations can protect their sensitive data and maintain the integrity of their systems against such vulnerabilities.

Recent updates to CVE-2024-3922 reflect a recalibration of its CVSS score from 9.8 to a maximum severity of 10.0, underscoring the critical nature of this SQL injection vulnerability in the Dokan Pro WordPress plugin. Although the EPSS score shows a slight decline, our telemetry indicates continued availability of proof-of-concept exploits, maintaining a persistent threat environment. This adjustment signals that the vulnerability’s potential impact on confidentiality, integrity, and availability is now fully recognized, emphasizing the ease with which unauthenticated attackers can leverage it to extract sensitive data. For defenders, this change elevates the urgency to monitor for exploitation attempts and reinforces the necessity of prioritizing detection capabilities. While exploitation activity has not surged markedly, the stable presence of functional exploits combined with the vulnerability’s critical rating demands sustained vigilance. The threat level remains at its highest, reflecting both the technical severity and the operational feasibility of attacks exploiting this flaw.

Update 2 — May 21, 2026

Recent adjustments to the CVSS and EPSS scores for CVE-2024-3922 reflect a refined understanding of the vulnerability’s exploitability and impact. The slight reduction in the CVSS score from 10.0 to 9.8, coupled with a marginal increase in the EPSS score to 0.8966, indicates that while the vulnerability remains critically severe, the probability of exploitation is marginally higher than previously assessed. CSURFACE threat intelligence confirms that the exploitability remains stable, with no significant surge in active exploitation attempts detected by our telemetry. However, the availability of proof-of-concept exploits continues to facilitate potential adversaries’ ability to weaponize this flaw. This nuanced shift underscores the importance for defenders to maintain heightened monitoring and detection capabilities, as the vulnerability’s critical nature and persistent exploit potential sustain a high threat level. The updated metrics suggest that while the immediate risk has not escalated dramatically, the environment remains conducive to exploitation, warranting ongoing vigilance.