Loading vulnerability…
CVE-2025-13390 is a critical authentication bypass vulnerability in the WP Directory Kit plugin for WordPress affecting all versions up to and including 1.4.4. The issue is caused by an incorrect implementation of the authentication algorithm in the wdk_generate_auto_login_link function. Specifically, the plugin's auto-login feature relies on a cryptographically weak, predictable token generation mechanism. Because the token can be predicted, an unauthenticated remote attacker can abuse the auto-login endpoint to authenticate as an administrator without valid credentials. Successful exploitation results in administrative access to the WordPress site and can lead to full site takeover.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a fully automated exploit for CVE-2025-13390, targeting the WP Directory Kit WordPress plugin (<= 1.4.4). The exploit is implemented in a single Python script (CVE-2025-13390.py) and is designed for mass exploitation using multi-threading. It works by exploiting a weak token generation vulnerability in the plugin's auto-login feature, allowing unauthenticated attackers to generate valid admin login tokens. The script then extracts admin session cookies and uses them to upload a malicious plugin (ZIP file containing a PHP shell named Nx.php) via the WordPress admin interface. Upon successful upload, the shell is accessible via a predictable URL, granting remote code execution. The script logs successful cookie extractions and shell uploads to separate files. The repository also includes a README with detailed usage instructions, a license file, and a requirements.txt listing Python dependencies. No hardcoded IPs or domains are present; all targets are user-supplied. The exploit is operational, requiring a prepared shell payload and a list of targets.
This repository contains a Bash exploit script (CVE-2025-13390.sh) and a detailed README for CVE-2025-13390, a critical authentication bypass and privilege escalation vulnerability in the WP Directory Kit WordPress plugin (versions <= 1.4.4). The exploit leverages a cryptographically weak auto-login token to gain administrative access by forging a predictable token for user_id=1 (typically the admin). Once authenticated, the script downloads a PHP webshell plugin from GitHub, repackages it to meet WordPress requirements, and uploads it via the admin interface. The script then verifies webshell access, providing the attacker with remote command execution as the web server user. The README provides in-depth technical analysis of the vulnerability, proof-of-concept details, and the full attack chain. The exploit is operational and automates the entire compromise process, requiring only the target URL as input.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.