PT-2025-6024 · WordPress · Wp Directorybox Manager

István Márton

·

Published

2025-02-08

·

Updated

2025-02-19

·

CVE-2025-0316

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WP Directorybox Manager plugin for WordPress versions up to, and including, 2.5
Description The issue is due to incorrect authentication in the wp dp enquiry agent contact form submit callback function, making it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
Recommendations For WP Directorybox Manager plugin for WordPress versions up to, and including, 2.5, consider disabling the wp dp enquiry agent contact form submit callback function until a patch is available to prevent exploitation.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-0316

Affected Products

Wp Directorybox Manager