CVE-2025-0316: 
WordPress vulnerability analysis and mitigation

The WP Directorybox Manager plugin for WordPress contains an authentication bypass vulnerability (CVE-2025-0316) discovered in versions up to and including 2.5. The vulnerability was disclosed on February 8, 2025, affecting the 'wpdpenquiryagentcontactformsubmit_callback' function. This security issue impacts WordPress installations using the affected versions of the WP Directorybox Manager plugin (NVD, RedHat CVE).

The vulnerability stems from incorrect authentication implementation in the 'wpdpenquiryagentcontactformsubmit_callback' function. The CVSS v3.1 base score is 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) (NVD).

A successful exploitation allows unauthenticated attackers to log in as any existing user on the site, including administrators, provided they have access to the username. This gives attackers potential full administrative access to the WordPress installation (NVD).

Users should immediately upgrade their WP Directorybox Manager plugin to a version newer than 2.5 if available. As this is a critical security issue, if an update is not available, consider disabling the plugin until a patch is released (NVD).