Security flaws in WooCommerce and the Dokan Pro plugin have been discovered

WooCommerce published an XSS (Cross Site Scripting) vulnerability, while Wordfence simultaneously warned of a critical vulnerability in the WooCommerce plugin - Dokan Pro. The Dokan Pro notice warned that an SQL Injection vulnerability could allow unauthorized attackers to extract sensitive information from a website's database. Wordfence indicated to SEJ that the free version of the Dokan Lite plugin was not affected.

"Dokan Pro allows users to turn their WooCommerce website into a multi-seller platform similar to sites like Amazon and Etsy. It currently has over 50,000 installs. Versions of the plugin up to and including 3.10.3 are vulnerable. According to WordFence, version 3.11.0 is fully patched and the most secure version."

🚀 Currently, only 30.6% of installations use the latest version, 3.11. It is important to note that this vulnerability does not affect Dokan Lite, these statistics only show what the version distribution is for the Lite version and may or may not indicate the version distribution for Dokan Pro.

• 📌 The manufacturer of Dokan Pro may not have wanted to warn hackers about a critical vulnerability, so the changelog for version 3.10.4, which was released on April 25, 2024 (and was supposed to be fixed), does not indicate that there is a fix.

🚀 The Common Vulnerability Scoring System (CVSS) is an open standard for assigning a score that represents the severity of a vulnerability. The Dokan Pro plugin has been rated CVSS 10, the highest severity level, which means that all users of the plugin are advised to take immediate action.

"Dokan Pro contains an Unauthenticated SQL Injection vulnerability. An SQL Injection vulnerability in WordPress is one in which a plugin or theme allows an attacker to manipulate the database. The database is the heart of every WordPress website, where all passwords, logins, messages, themes, and plugin data are stored. A vulnerability that allows anyone to manipulate the database is extremely serious."