Loading vulnerability…
Authentication Bypass in WP Directory Kit auto-login endpoint
CVE-2025-13390 is a critical authentication bypass vulnerability in the WP Directory Kit plugin for WordPress affecting all versions up to and including 1.4.4. The issue is caused by an incorrect implementation of the authentication algorithm in the wdk_generate_auto_login_link function. Specifically, the plugin's auto-login feature relies on a cryptographically weak, predictable token generation mechanism. Because the token can be predicted, an unauthenticated remote attacker can abuse the auto-login endpoint to authenticate as an administrator without valid credentials. Successful exploitation results in administrative access to the WordPress site and can lead to full site takeover.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated attacker to bypass authentication and obtain administrative access to the affected WordPress instance. With administrator-level control, the attacker can fully compromise the site, including modifying site content and configuration, creating or altering accounts, installing or modifying plugins/themes, accessing sensitive data, and potentially executing further malicious actions through the WordPress administrative interface. The reported impact is consistent with full compromise of confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If an immediate update is not possible, disable the WP Directory Kit plugin or specifically disable/remove exposure to its auto-login functionality and endpoint until a fixed version can be deployed. Restrict access to the affected WordPress administrative surface where feasible, monitor for suspicious logins or unexpected administrator creation, and review logs for abuse of the auto-login endpoint. Because the issue is due to predictable authentication tokens, mitigation should focus on eliminating access to the vulnerable feature rather than relying on obscurity.
Patch, then assume compromise.
Update the WP Directory Kit plugin to a fixed version that corrects the weak token generation and authentication logic in the auto-login functionality. The provided context indicates that versions up to and including 1.4.4 are affected, so organizations should upgrade to the vendor-fixed release newer than 1.4.4. After patching, review the implementation of the authentication mechanism, inspect administrative accounts and recent login activity for unauthorized access, and rotate credentials or session material if compromise is suspected.
2 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.