CVE-2025-13090: 
WordPress vulnerability analysis and mitigation

CVE-2025-13090 is a SQL Injection vulnerability in the WP Directory Kit plugin for WordPress, affecting all versions up to and including 1.4.6. The flaw exists in the search parameter due to insufficient escaping of user-supplied input and inadequate SQL query preparation. It was published on December 2, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 4.9 (Medium), though Feedly's category estimate rates it as High (Wordfence, Red Hat CVE).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where the search parameter in the WP Directory Kit plugin is not properly escaped or parameterized before being incorporated into SQL queries. An authenticated attacker with Administrator-level access can append additional SQL statements to existing queries, enabling extraction of sensitive data from the WordPress database. The attack vector is network-based, requires no user interaction, and has low attack complexity, though it does require high privileges (Administrator role). Patch changesets are publicly available in the WordPress plugin repository (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated administrator to extract sensitive information from the WordPress database, including user credentials, personal data, configuration details, and other confidential records stored in the database. The impact is limited to confidentiality — there is no integrity or availability impact based on the CVSS assessment. While the requirement for Administrator-level access limits the attack surface, a compromised admin account or a malicious administrator could leverage this vulnerability to exfiltrate the entire database contents (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13090. The EPSS score is approximately 0.023% (0.000230), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high privilege requirement (Administrator access) significantly reduces the practical exploitability of this vulnerability (Wordfence).

1. Authentication: Log in to the WordPress site with an Administrator-level account (or higher).
2. Locate the vulnerable parameter: Navigate to the WP Directory Kit plugin's search functionality, which processes the search parameter in its backend queries.
3. Craft a SQL injection payload: Append SQL syntax to the search parameter value (e.g., using UNION-based or time-based blind injection techniques) to extend the existing query.
4. Extract database contents: Use the injected SQL to retrieve sensitive tables such as wp_users (containing hashed passwords and emails), wp_options (containing configuration secrets), or other custom tables.
5. Exfiltrate data: Collect the query results returned in the plugin's response or infer data through blind injection timing responses (Wordfence).

• Logs: WordPress access logs showing unusual or malformed requests to WP Directory Kit search endpoints containing SQL syntax characters (e.g., UNION, SELECT, --, ', OR 1=1) in the search parameter.
• Database: Unexpected or anomalous database query patterns in MySQL slow query logs or general query logs, particularly queries involving UNION SELECT or multi-statement patterns originating from the plugin's query context.
• Network: Repeated or automated HTTP requests to the WP Directory Kit search endpoint from a single authenticated session, potentially indicating automated SQL injection tooling (e.g., sqlmap).

Users should update the WP Directory Kit plugin to version 1.4.7 or later, which includes fixes for the SQL injection vulnerability as reflected in the plugin's changelog and repository changesets. No configuration-based workaround is available; upgrading is the only recommended remediation. Site administrators should also audit administrator accounts for unauthorized access and review database logs for signs of prior exploitation (Wordfence, WordPress Trac).