What the vulnerability does
01Description
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.
Explanation of Vulnerability in Simple Terms
02Summary
WP Directory Kit versions 1.4.0 through 1.4.4 contain a critical vulnerability that allows unauthenticated attackers to gain complete control of the site over the network. No user interaction or special configuration is required. The vulnerability affects confidentiality, integrity, and availability of the entire site. Update to a version newer than 1.4.4 immediately.
What an attacker can do
03Attacker Capabilities
Run arbitrary code on the site, read all data, modify or delete content, and take the site offline.
Potential impact on your site
04Site Impact
Complete compromise of the WordPress site and all its data without any warning or user action needed.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
December 3, 2025
CVE published
December 8, 2025
Record updated
