CVE-2025-13390 — AI Deep Analysis Summary

🚨 **Essence**: WP Directory Kit ≤1.4.4 has a critical **Authentication Bypass**. The auto-login token uses a weak MD5 hash of only the first 10 chars of `user_id`.…

🛡️ **Root Cause**: **CWE-303** (Improper Authentication). The flaw lies in the **cryptographically weak token generation**. It relies on a predictable MD5 prefix of the user ID instead of a secure, random session token.…

📦 **Affected**: **WP Directory Kit** plugin by **listingthemes**. 📉 **Versions**: **1.4.4 and earlier**. 🌐 **Platform**: WordPress sites running this specific plugin version.…

👑 **Privileges**: Attackers gain **Administrator Access**. 📂 **Data**: Full read/write access to all site data, plugins, themes, and database.…

📉 **Threshold**: **Extremely Low**. 🚫 **Auth Required**: **None**. No login needed. ⚙️ **Config**: No special configuration required. The vulnerability is inherent in the code logic for `user_id=1` (default admin).…

🔓 **Public Exp**: **YES**. Multiple PoCs are available on GitHub (e.g., `d0n601`, `Nxploited`). 🧪 **Scanners**: Nuclei templates (`CVE-2025-13390.yaml`) are already live.…

🔍 **Self-Check**: 1. Check plugin version in WP Dashboard. 2. Scan for `WP Directory Kit` ≤1.4.4. 3. Use Nuclei or similar scanners with the CVE-2025-13390 template. 4.…

🩹 **Fix**: **YES**. Official patch released via WordPress Trac (Changeset 3400599). 📅 **Published**: Dec 3, 2025. ✅ **Action**: Update WP Directory Kit to the latest version immediately.…

🚧 **Workaround**: If patching is delayed, **disable the plugin** entirely. 🚫 **Block Access**: Restrict access to the plugin's auto-login endpoints via WAF or `.htaccess`.…

🔥 **Urgency**: **CRITICAL / IMMEDIATE**. 🚨 **Priority**: **P0**. CVSS Score is **High** (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). ⏳ **Risk**: Active exploitation is highly probable.…