Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 23:21:07 +0000 CVE-2025-13390 — WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover https://cve.radiocsirt.org/vuln/cve-2025-13390 <p><strong>Affected:</strong> listingthemes WP Directory Kit</p> <p>The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the &#34;wdk_generate_auto_login_link&#34; function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.</p> <p><strong>Affected:</strong> listingthemes WP Directory Kit</p> <p>The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the &#34;wdk_generate_auto_login_link&#34; function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.</p> https://cve.radiocsirt.org/vuln/cve-2025-13390