PT-2025-48809 · WordPress · Wp Directory Kit

Ryan Kozak · Published 2025-12-03 · Updated 2026-04-20 · CVE-2025-13390

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.4.5

Description The WP Directory Kit plugin for WordPress has a flaw in its authentication process. Specifically, versions up to and including 1.4.4 are susceptible to authentication bypass due to a weak token generation mechanism within the wdk generate auto login link function. This allows unauthenticated attackers to gain administrative access and potentially take full control of a site by exploiting the auto-login endpoint with a predictable token.

Recommendations Update WP Directory Kit to version 1.4.5 or later. As a temporary workaround, consider disabling the auto-login feature if it is not essential. Restrict access to the auto-login endpoint.

Exploit

Fix

LPE

Weakness Enumeration

CWE-303

Related Identifiers

CVE-2025-13390

Affected Products

Wp Directory Kit

References · 15

• 🔥 https://github.com/d0n601/CVE-2025-13390 · Exploit
• 🔥 https://ryankozak.com/posts/cve-2025-13390 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13390 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13390 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3400599/wpdirectorykit · Patch
• https://twitter.com/MNovofastovsky/status/1996936842336157938 · Twitter Post
• https://twitter.com/SecAideInfo/status/1997248305793798172 · Twitter Post
• https://t.me/CVEtracker/38750 · Telegram Post
• https://twitter.com/cracbot/status/1997984550883074512 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2046167027505889773 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2043857092549685269 · Twitter Post
• https://twitter.com/dailycve/status/2001120462424653840 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6598d171-e68c-4d2f-9cd1-f1574fa90433?source=cve · Note
• https://twitter.com/SecReportCVE/status/2006374791557566883 · Twitter Post
• https://t.me/cveNotify/144612 · Telegram Post