CVE-2026-24359: 
WordPress vulnerability analysis and mitigation

CVE-2026-24359 is a Broken Authentication (Authentication Bypass Using an Alternate Path or Channel) vulnerability in the Dokan dokan-lite WordPress plugin, developed by Dokan, Inc. It affects all versions up to and including 4.2.4, with version 4.2.5 being the first patched release. The vulnerability was reported on December 14, 2025, by researcher "daroo" and published by Patchstack on March 16, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (Patchstack).

The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), meaning the plugin fails to properly enforce authentication controls, allowing attackers to reach privileged functionality through an alternate code path or channel. Exploitation requires only low-level privileges (e.g., a Subscriber-level WordPress account) and no user interaction, and is achievable remotely over the network with low attack complexity. The flaw is categorized under OWASP Top 10 A7: Identification and Authentication Failures, and could allow a low-privileged user to perform actions normally restricted to higher-privileged roles, potentially including administrative actions (Patchstack).

Successful exploitation allows a low-privileged attacker (e.g., a registered subscriber) to bypass authentication controls and perform actions reserved for higher-privileged users, potentially gaining administrative access to the WordPress site. This could result in high confidentiality, integrity, and availability impacts — including unauthorized access to sensitive data, unauthorized modification of site content or settings, and potential service disruption. The broad install base of the Dokan plugin across WooCommerce-based multi-vendor marketplaces amplifies the potential scope of impact (Patchstack).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Patchstack). The EPSS score is approximately 0.024%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack rates it as high priority and notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity.

The vendor has released version 4.2.5 of the Dokan dokan-lite plugin, which resolves this vulnerability. All users running version 4.2.4 or earlier should update immediately. Patchstack has also issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until the plugin is updated; Patchstack users can additionally enable auto-update for vulnerable plugins (Patchstack). As a general precaution, administrators should review user roles and monitor for unauthorized access attempts on affected installations.