CVE-2025-13390— WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-13390
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
Source: NVD (National Vulnerability Database)
Vulnerability Description
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
认证算法的不正确实现
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress plugin WP Directory Kit 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin WP Directory Kit 1.4.4及之前版本存在安全漏洞，该漏洞源于身份验证算法实现不当，可能导致未经授权的攻击者获得管理员权限并完全接管站点。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| listingthemes | WP Directory Kit | 1.4.0 ~ 1.4.4 | - |
II. Public POCs for CVE-2025-13390
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover | https://github.com/d0n601/CVE-2025-13390 | POC Details |
| 2 | WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover | https://github.com/Nxploited/CVE-2025-13390 | POC Details |
| 3 | The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism that uses only the first 10 characters of MD5(user_id). For user_id=1 (typically admin), the token is always predictable. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13390.yaml | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-13390
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: WP Directory Kit
- CVE-2025-13920
WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure v - CVE-2025-13089
WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection - CVE-2025-13090
WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injec - CVE-2025-13525
WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting v - CVE-2025-13138
WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection vi
Same weakness: CWE-303
- CVE-2026-33190
CoreDNS TSIG authentication bypass on encrypted DNS transpor - CVE-2026-27656
Account Takeover via Substring Matching in OpenID Connect Au - CVE-2026-32953
Tillitis: TKey Client has an Error in Protocol Implementatio - CVE-2026-29515
MiCode FileExplorer SwiFTP Server Authentication Bypass - CVE-2019-25436
Sricam DeviceViewer 3.12.0.1 Password Change Security Bypass
V. Comments for CVE-2025-13390
No comments yet