CVE-2025-13390

nvd nist nuclei

Published: Dec 3, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.

Affected (1)

Products: Wpdirectorykit: Wp Directory Kit

1 product

Wp Directory Kit

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wpdirectorykit Wp Directory Kit	Up to 1.4.4

Related CWEs

Incorrect Implementation of Authentication Algorithm

The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

References (5)

https://github.com/d0n601/CVE-2025-13390

Source: security@wordfence.com

ExploitThird Party Advisory

https://plugins.trac.wordpress.org/changeset/3400599/wpdirectorykit/

Source: security@wordfence.com

Patch

https://ryankozak.com/posts/cve-2025-13390/

Source: security@wordfence.com

Exploit

https://www.wordfence.com/threat-intel/vulnerabilities/id/6598d171-e68c-4d2f-9cd1-f1574fa90433?source=cve

Source: security@wordfence.com

Third Party Advisory

https://github.com/d0n601/CVE-2025-13390

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.