WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

The impact of CVE-2025-13390 is severe. Successful exploitation allows an attacker to bypass authentication entirely, granting them full administrative privileges on the WordPress site. This means the attacker can modify any content, install malicious plugins, steal sensitive data (user credentials, customer information, financial data), and even deface the website. The predictable token generation mechanism makes exploitation relatively straightforward, increasing the likelihood of attacks. This vulnerability shares similarities with other authentication bypass flaws where weak token generation is the root cause, potentially leading to widespread compromise if left unaddressed.

Websites utilizing the WP Directory Kit plugin, particularly those running versions 1.4.0 through 1.4.4, are at significant risk. Shared hosting environments where multiple websites share the same server are also at increased risk, as a compromise of one site could potentially lead to the compromise of others. Sites with weak password policies or those that haven't recently updated their WordPress installation are particularly vulnerable.

• wordpress / composer / npm:

grep -r 'wdk_generate_auto_login_link' /var/www/html/wp-content/plugins/wp-directory-kit/

• wordpress / composer / npm:

wp plugin list | grep "WP Directory Kit"

• wordpress / composer / npm:

wp plugin update wp-directory-kit --version=1.4.5

• generic web: Check WordPress plugin directory for mentions of CVE-2025-13390 and WP Directory Kit.

1. 2025-12-03Disclosure

   disclosure

1. Gereserveerd2025-11-18
2. Gepubliceerd2025-12-03
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-13390 is to immediately upgrade the WP Directory Kit plugin to version 1.4.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the auto-login endpoint. This can be achieved by modifying the .htaccess file to deny access to the endpoint or by implementing a custom firewall rule. Monitor WordPress logs for suspicious activity, particularly attempts to access the auto-login endpoint. After upgrading, verify the fix by attempting to access the auto-login endpoint without authentication; access should be denied.

Actieve installaties

3KNiche

Plugin-beoordeling