CVE-2025-13390 describes a critical authentication bypass vulnerability in the WP Directory Kit plugin for WordPress, affecting all versions up to and including 1.4.4. This flaw stems from a cryptographically weak token generation mechanism in the "wdk_generate_auto_login_link" function. Unauthenticated attackers can exploit this to gain administrative access and achieve full site takeover through the auto-login endpoint. The vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a severe risk due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. Its FAUCET Risk Score is 93/100, further highlighting its high potential impact. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting low public awareness at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.4.4CPE matchmatch criteria | cpe:2.3:a:wpdirectorykit:wp_directory_kit:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.