Paper/Archive/CVE-2025-13390

CVE-2025-13390

listingthemes WP Directory Kit — WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

EPSS 5%public exploit CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 91.6.916 × 2018.3 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.

Affected

ProductAffectedFixed inSource

WP Directory Kit1.4.0 – 1.4.4–CNA

Scores by source

Wordfence (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refryankozak.com/posts/cve-2025-13390 refplugins.trac.wordpress.org/changeset/3400599/wpdirectorykit exploitgithub.com/d0n601/CVE-2025-13390 refwordfence.com/threat-intel/vulnerabilities/id/6598d171-e68c-4d2f-9cd1-f1574fa90433?source=cve