Critical · published December 3, 2025
🚨 A tiny flaw in the WP Directory Kit plugin is your golden ticket for unauthorized access—unauthenticated attackers can waltz right in! 🔥 Think of this vulnerability like a hotel that gives out keys without verifying guests—anyone can walk in, order room service, and throw a wild party! 🏨🍾 With full administrative access, an attacker could wreak absolute havoc: they could steal sensitive data, modify site content, or even use your site for malicious purposes. It's an open invitation for chaos, leaving your users and your reputation hanging by a thread! ⚡
Think of this vulnerability like a hotel that gives out keys without verifying guests—anyone can walk in, order room service, and throw a wild party! 🏨🍾 This vulnerability arises from a weak token generation mechanism in the 'wdk_generate_auto_login_link' function, allowing unauthenticated users to obtain a predictable token and log in as an admin.
With full administrative access, an attacker could wreak absolute havoc: they could steal sensitive data, modify site content, or even use your site for malicious purposes. It's an open invitation for chaos, leaving your users and your reputation hanging by a thread! ⚡ Immediately update the WP Directory Kit plugin to version 1.4.5 or later to close this vulnerability. Additionally, review all other plugins for similar auto-login features and ensure they employ robust authentication methods. 🛡️ You’ve got this! Take these steps to secure your site and protect your users. 🌟
| Product | Versions | Fixed in |
|---|---|---|
| wpdirectorykit/wp_directory_kit | ≤ 1.4.4 | — |