CVE-2025-13390 is a critical authentication bypass, scored 10.0 by CVSS 3.1, in the WP Directory Kit plugin for WordPress, all versions up to and including 1.4.4. A weak auto-login token can let an unauthenticated attacker become an administrator. The advisory pages do not confirm a fixed version, so check the plugin page.
What's affected
WP Directory Kit versions 1.4.4 and below. The record says the cause is incorrect implementation of the authentication algorithm in the wdk_generate_auto_login_link function, which relies on a cryptographically weak token.
The researcher write-up I fetched says the token depends only on the user ID, so the site's secret key adds no protection, and that the auto-login feature stays active whenever the plugin is enabled. The write-up does not state a fixed version or disclosure dates. The record references a changeset on the WordPress plugin repository, which I could not read, so confirm the patched release on the plugin page or in the Wordfence entry.
The score of 10.0 includes a changed scope in the CVSS vector. The record does not mark the flaw as a CISA Known Exploited Vulnerability and none of the pages I read say it is exploited in the wild.
How to check if you're exposed
In the WordPress admin, open the Plugins page and look for WP Directory Kit and its version. With WP-CLI:
wp plugin list --name=wpdirectorykit --fields=name,status,version
If the version is 1.4.4 or lower and the plugin is active, treat the site as exposed. Next, review administrator accounts. Any admin you do not recognise, or a recent change to an existing admin, needs investigation. Check the plugin list for anything you did not install and look at access logs for unexpected logins.
wp user list --role=administrator --fields=ID,user_login,user_registered
What to do now
- Find every WordPress site that uses WP Directory Kit, including staging copies.
- Check the plugin page for a release newer than 1.4.4 and update if one is listed. Confirm the release notes mention the auto-login fix.
- If no fixed release is confirmed, deactivate and remove the plugin. The advisory says the auto-login cannot be switched off in settings.
- Audit administrator accounts and remove any you cannot explain.
- Reset passwords for administrators and rotate the WordPress salts in
wp-config.phpafter any suspected compromise. - Look for unknown plugins, modified theme files and new scheduled tasks.
- Restore from a clean backup if you find signs of takeover.
Why it matters
The weakness is CWE-303 (incorrect implementation of an authentication algorithm). A login link is only safe if its token cannot be guessed. When the token comes from something an outsider can know, such as a user ID, the link is the same as a password that is public.
The result described by the record is full site takeover. An administrator on WordPress can install plugins and edit code, so a bypass like this reaches past the site itself to the server account. Plugins add attack surface that a core WordPress install does not have, so keep an inventory and remove what you do not use.
A dependency inventory finds installs like this across many sites. See the Gold directory for the entry.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions of WP Directory Kit are affected?
All versions up to and including 1.4.4, according to the record.
Can I switch off the auto-login feature?
The researcher write-up says it stays active whenever the plugin is enabled and cannot be disabled in settings. Removing the plugin is the safe option until a fixed release is confirmed.
Sources
Last reviewed: 19 October 2026.
