An incorrect privilege assignment flaw in the Dokan dokan-lite plugin enables an attacker to gain elevated privileges on a WordPress site. The vulnerability allows a user with limited access to be promoted to a higher role, giving them full control of the plugin and potentially the entire site. This is a classic access‑control weakness categorized as CWE‑266.

The flaw affects all Dokan dokan‑lite plugin installations up to and including version 4.1.3. Any WordPress site running Dokan dokan‑lite 4.1.3 or earlier is vulnerable.

The CVSS score of 7.2 indicates a high likelihood of successful exploitation if the attacker can become a regular user. The EPSS score of less than 1% suggests that, so far, exploitation attempts are rare, and the vulnerability is not listed in the CISA KEV catalog. The most plausible attack vector is an authenticated user exploiting the misconfiguration to acquire additional roles; this may require the attacker to have access to the site via an existing account or to submit content that triggers the flaw.