CVE-2025-13390

Katalog CVE

CVSS 9.8 · Critical EPSS 4,6%

Kerentanan Incorrect Implementation of Authentication Algorithm pada wpdirectorykit wp directory kit. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.

Rincian

Terbit di NVD

3 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-303: Incorrect Implementation of Authentication Algorithm

EPSS (30 hari)

4,6% peluang dieksploitasi; lebih tinggi dari 91,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset/3400599/wpdirectorykit/ patch
• https://github.com/d0n601/CVE-2025-13390 exploit · advisory pihak ketiga
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6598d171-e68c-4d2f-9cd1-f1574fa90433?source=cve advisory pihak ketiga
• https://ryankozak.com/posts/cve-2025-13390/ exploit