CVE-2024-3922 is a critical SQL injection in the Dokan Pro plugin for WordPress, scored 10.0 by NVD. All versions up to and including 3.10.3 are affected, and unauthenticated attackers can read database content. Update to a release newer than 3.10.3 and confirm the exact fixed version in the Dokan changelog.
What's affected
The record names the Dokan Pro plugin, all versions up to and including 3.10.3. The description says the flaw is in the code parameter, where the user supplied value is not escaped enough and the SQL query is not prepared. The first fixed version is not stated in the record, which links the Dokan changelog and the Wordfence entry instead. Read the changelog to find the release that closes it.
The score of 10.0 uses the changed scope flag and high impact on confidentiality, integrity and availability, with no authentication and no user action. The description itself speaks only of extracting sensitive information from the database. Note that the high integrity and availability ratings in the score are broader than that wording.
The KEV flag is false, and neither linked source in the record reports exploitation in the wild.
The NVD record is dated 2024-06-13 and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, a score of 10.0 (Critical). Weakness class: CWE-89.
How to check if you're exposed
In WordPress, open Plugins, find Dokan Pro and read its version. If it is 3.10.3 or lower, it is affected.
With WP-CLI you can check many sites quickly.
wp plugin list --name=dokan-pro --fields=name,version,status
Multi vendor marketplaces often run several staging and regional copies, so check each one. Also look at web server logs for odd requests carrying a code parameter against marketplace endpoints, and at database logs for unusual queries, if you keep them.
Free dependency scanning needs no account: paste a manifest into the in-browser scan to see which known CVEs apply to the libraries you ship. The Gold directory lists each CVE with its affected packages.
What to do now
- Update Dokan Pro to a release newer than 3.10.3, using the changelog to pick the first fixed one.
- If you cannot update at once, put the site behind a web application firewall rule for SQL injection and consider taking the affected feature offline.
- Review access and database logs from before the update for suspicious requests to the plugin.
- Rotate database credentials and administrator passwords if you see signs of data access.
- Check that WordPress itself and other plugins are current, since one vulnerable plugin is often not the only one.
Why it matters
The weakness is SQL injection, CWE-89. A user supplied value is placed into a SQL statement without being escaped or bound as a parameter, so the database can read the value as part of the query. The standard defence is prepared statements, where the query structure is fixed and the value travels separately.
The risk is raised by two facts in the record: no login is needed, and the plugin runs a store, so the database holds customer, order and vendor data. Marketplace sites carry real personal data, which raises the cost of any exposure for the owner.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be logged in to exploit this?
No. The record describes unauthenticated attackers, so any visitor who can reach the site is a possible source.
What is the fixed version?
The record does not state one. It only says versions up to and including 3.10.3 are affected, so use the Dokan changelog.
Sources
Last reviewed: 19 October 2026.
