An authentication bypass flaw exists in Dokan Lite versions through 4.2.4, classified as CWE‑288. The plugin allows an attacker to obtain access by using an alternate path or channel, bypassing normal authentication controls. This enables a user without valid credentials to perform actions that normally require a logged‑in session, potentially exposing sensitive data, enabling unauthorized administrative actions, and allowing the modification or disruption of site content.

All releases of the Dokan Lite WordPress plugin up to version 4.2.4 are affected. Any WordPress installation that includes Dokan Lite with a version less than or equal to 4.2.4 is vulnerable. The product in question is Dokan Lite from Dokan, Inc.

The CVSS base score of 8.8 indicates high severity, while an EPSS probability of less than 1% suggests that exploitation is currently unlikely. The flaw is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely remote via the website’s request path; no local or privileged conditions are specified, so it is inferred that exploitation can occur from a remote location without requiring local access. An attacker could trigger the bypass by sending a crafted request to an alternate endpoint that the plugin does not properly protect, gaining authenticated privileges.