CVE-2025-13390: 
WordPress vulnerability analysis and mitigation

CVE-2025-13390 is an authentication bypass vulnerability in the WP Directory Kit plugin for WordPress, affecting all versions up to and including 1.4.4. The flaw resides in the wdk_generate_auto_login_link function, which uses a cryptographically weak token generation mechanism, allowing unauthenticated attackers to gain administrative access and achieve full site takeover. It was published on December 3, 2025, and a patch was released on December 16, 2025. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, Feedly).

The root cause is classified as CWE-303 (Incorrect Implementation of Authentication Algorithm). The wdk_generate_auto_login_link function in application/helpers/Basic.php generates a login token by computing substr(md5($user_id).NONCE_KEY.'wpdirectorykit', 0, 10). Because md5($user_id) already produces 32 characters and only the first 10 characters are taken, the NONCE_KEY secret is never included in the token — the token is simply the first 10 hex characters of the MD5 hash of the user ID. For user ID 1 (almost always an administrator), this is the static, predictable value c4ca4238a0. The auto-login endpoint (/?auto-login=1&user_id=<id>&token=<token>) is hardcoded in actions.php and cannot be disabled, making every installation with the plugin active exploitable with no authentication or user interaction required (GitHub PoC, Researcher Blog).

Successful exploitation grants an unauthenticated attacker full administrative access to the WordPress site, resulting in complete compromise of confidentiality, integrity, and availability. Attackers can install malicious plugins (including web shells), create rogue administrator accounts, exfiltrate all site data, and deploy malware — effectively achieving total site takeover. The scope is limited to the affected WordPress installation, but lateral movement to the underlying server is possible via web shell installation, as demonstrated in public proof-of-concept code (GitHub PoC, Feedly).

Multiple public proof-of-concept exploits are available, including a functional Bash script by researcher d0n601 that automates the full attack chain from authentication bypass to web shell installation, and a second PoC by Nxploited published in March 2026 (GitHub PoC, GitHub PoC2). A Nuclei detection template has also been added to the ProjectDiscovery nuclei-templates repository, enabling automated scanning. The EPSS score is approximately 0.30%, and there is no confirmed evidence of in-the-wild exploitation or CISA KEV catalog listing as of the available data. No specific threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify WordPress sites running the WP Directory Kit plugin (versions ≤ 1.4.4) using tools like WPScan, Shodan, or Censys by searching for plugin-specific indicators (e.g., /wp-content/plugins/wpdirectorykit/).
2. Compute the predictable token: For user ID 1 (the default administrator), calculate the token as the first 10 characters of the MD5 hash of the user ID: echo -n '1' | md5sum → c4ca4238a0b923820dcc509a6f75849b, token = c4ca4238a0. For other user IDs, compute accordingly.
3. Trigger the auto-login endpoint: Send a GET request to https://target.com/?auto-login=1&user_id=1&token=c4ca4238a0. The server validates the token, calls wp_set_auth_cookie(1), and returns WordPress authentication cookies in the HTTP response.
4. Capture authentication cookies: Save the returned cookies (wordpress_logged_in_[hash] and wordpress_[hash]) using a tool like curl -c cookies.txt or a browser.
5. Access the WordPress admin panel: Use the captured cookies to authenticate to /wp-admin/, confirming administrative access.
6. Install a malicious plugin (web shell): Retrieve the WordPress nonce from /wp-admin/plugin-install.php, then upload a malicious plugin ZIP file via POST /wp-admin/update.php?action=upload-plugin using the nonce and session cookies.
7. Execute arbitrary commands: Access the installed web shell (e.g., /wp-content/plugins/wp_webshell/wp_webshell.php?cmd=id) to execute OS-level commands as the web server user (www-data), enabling data exfiltration, reverse shells, or further lateral movement (GitHub PoC, Researcher Blog).

• Network: Unusual GET requests to /?auto-login=1&user_id=1&token=c4ca4238a0 (or other user IDs) in web server access logs; HTTP 302 redirects from the auto-login endpoint followed by authenticated admin activity from previously unknown IPs.
• Logs: WordPress access logs showing requests to /?auto-login=1 with user_id and token parameters; admin activity (plugin installs, user creation) from IP addresses with no prior login history; entries in wp-admin/update.php for plugin uploads not initiated by known administrators.
• File System: Unexpected PHP files in /wp-content/plugins/ directories, particularly web shell scripts (e.g., wp_webshell.php); newly created plugin directories not corresponding to legitimate installed plugins.
• Process: Unusual child processes spawned by the web server process (e.g., www-data executing bash, curl, wget, or python); outbound network connections from the web server to unknown external IPs (GitHub PoC).

Update the WP Directory Kit plugin to version 1.4.5 or later, which was released on December 16, 2025, and addresses the weak token generation flaw (WordPress Changeset). No official configuration-based workaround exists, as the auto-login endpoint is hardcoded and cannot be disabled without modifying plugin code. As an interim measure, site administrators may consider deactivating or removing the plugin entirely until the patch can be applied, and should audit WordPress admin accounts and installed plugins for signs of unauthorized changes (Wordfence).

The vulnerability was discovered and disclosed by researcher Ryan Kozak, who published a detailed technical write-up on his blog (Researcher Blog). Wordfence, which assigned the CVE, rated it as critical and highlighted the ease of exploitation and complete compromise potential. The vulnerability was mentioned in The Hacker News weekly recap for the week of December 8, 2025, alongside other notable vulnerabilities. Community interest has been sustained, with multiple Nuclei detection templates contributed to the ProjectDiscovery repository and social media discussion on Bluesky (Feedly).