The issue is an Authentication Bypass Using an Alternate Path or Channel that permits attackers to circumvent the standard login process for the WordPress Vitepos Lite plugin. By exploiting this flaw, an unauthenticated user or an attacker with limited access could gain privileged control over the plugin's administration interface, allowing them to alter store data, manage transactions, or redistribute sensitive information. The vulnerability is classified under CWE‑288 and results in unauthorized access to core functionalities.

All WordPress sites running the Vitepos Lite plugin by appsbd with version 3.1.4 or earlier are affected. Any installation that has not upgraded beyond 3.1.4 remains vulnerable.

The flaw carries a CVSS score of 8.8, indicating high severity, while its EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must send a specially crafted request to an alternate path or channel to bypass authentication, a technique typically exploitable over the public network. Although the potential impact is significant, the limited exploitation likelihood makes patching a priority.