What is the CVSS score of CVE-2026-24359?

CVE-2026-24359 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Dokan are affected by CVE-2026-24359?

CVE-2026-24359 presents significant security risk rated CVSS 8.8. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-24359?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Dokan CVE-2026-24359

EUVD-2026-15555 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-03-25 Patchstack

GHSA-hmc6-qjjc-3rjm

Authentication Bypass Dokan

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15555

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.8

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in Dokan, Inc. Dokan dokan-lite allows Authentication Abuse.This issue affects Dokan: from n/a through <= 4.2.4.

AnalysisAI

An authentication bypass vulnerability exists in Dokan (Dokan, Inc.) dokan-lite plugin versions through 4.2.4 that allows attackers to abuse authentication mechanisms via an alternate path or channel, potentially gaining unauthorized access without valid credentials. This issue affects the popular WordPress e-commerce plugin used by multivendor marketplace sites. The vulnerability has been identified by Patchstack and tracked under EUVD-2026-15555, though CVSS scoring and active exploitation data are not yet available.

Technical ContextAI

The vulnerability is classified as CWE-288 (Authentication Using an Alternate Path or Channel), which describes a situation where authentication logic can be circumvented by accessing functionality through an unprotected or differently-protected pathway. In the context of Dokan dokan-lite (cpe:2.3:a:dokan,_inc.:dokan:*:*:*:*:*:*:*:*), this WordPress plugin provides multivendor marketplace functionality including vendor management, product listings, and payment processing. The root cause involves improper authentication checks on certain plugin endpoints or functions, allowing attackers to invoke protected operations without proper verification. The vulnerability likely affects REST API endpoints, administrative functions, or vendor-specific operations that rely on insufficient or bypassable authentication mechanisms.

RemediationAI

Immediately upgrade Dokan dokan-lite to a version later than 4.2.4 (check the official Dokan release notes at https://dokan.co for the specific patched version). As an interim mitigation measure, organizations unable to immediately patch should restrict direct access to the WordPress installation via Web Application Firewall (WAF) rules, implement strict IP allowlisting for administrative endpoints, disable the Dokan plugin if it is not actively in use, and monitor logs for suspicious authentication attempts or unauthorized vendor account access. Additionally, enforce strong authentication on the WordPress user accounts with administrative or vendor roles, and consider implementing multi-factor authentication (MFA) for sensitive marketplace operations.