WP Directory Kit CVE-2025-13390

The target site must have the WP Directory Kit plugin installed and active at version ≤1.4.4 (EUVD: 1.4.0 through 1.4.4), and the auto-login link feature backed by the vulnerable wdk_generate_auto_login_link function must be reachable at its auto-login endpoint. Exploitation requires no authentication, no user interaction, and works against default deployments because the token-generation mechanism itself is cryptographically weak and predictable - there is no configuration hardening that the description identifies as mitigating short of patching. The practical limiting factor is purely footprint: only sites running this specific plugin and version range are affected, not WordPress generally.

Signals converge on genuine high priority. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with full C/I/A impact, and this is corroborated by the description: a cryptographically weak, predictable token in the auto-login endpoint yields direct administrative access and full site takeover - a CWE-303 authentication-bypass that matches the vector cleanly with no contradiction between vector and prose. Publicly available exploit code (two independent write-ups plus a GitHub PoC) lowers the skill barrier, and a vendor patch exists, which typically accelerates reverse-engineering and opportunistic mass scanning of WordPress plugins. The one tempering signal is EPSS: 0.66% (71st percentile) is modest and not yet in KEV, indicating that observed/predicted real-world exploitation volume is still limited rather than widespread - likely because the affected product is a single plugin with a bounded install base rather than because exploitation is hard. No SSVC decision data was provided in the input, so the SSVC exploitation/automatable/technical-impact framing cannot be independently stated. Net: treat as an urgent patch item for any site running this plugin (trivial full compromise, public PoC), while recognizing EPSS suggests the absolute number of targets is limited rather than internet-wide.

An unauthenticated attacker identifies a WordPress site running WP Directory Kit ≤1.4.4, computes or guesses the predictable auto-login token because of the weak token-generation algorithm, and submits it to the auto-login endpoint. The server grants an authenticated administrator session, giving the attacker full site takeover (plugin/theme upload, PHP code execution, user manipulation). Public exploit code (GitHub d0n601 PoC and two technical write-ups) makes this reproducible with minimal effort given AV:N/AC:L.