CVE-2025-13390 PoC — WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

Title:WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover (CVE-2025-13390)
Description:The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.

The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism that uses only the first 10 characters of MD5(user_id). For user_id=1 (typically admin), the token is always predictable.

 id: CVE-2025-13390

info:
  name: WP Directory Kit <= 1.4.4 - Authentication Bypass
  author: maxthe

...