CVE-2025-60120: WP Directory Kit Auth Bypass Vulnerability

CVE-2025-60120 Overview

CVE-2025-60120 is a Missing Authorization vulnerability [CWE-862] affecting the WP Directory Kit plugin for WordPress. The flaw exists in all versions up to and including 1.4.0. Attackers can exploit incorrectly configured access control security levels to reach functionality that should require authentication or elevated privileges. The vulnerability is exploitable over the network without authentication or user interaction. Successful exploitation results in unauthorized access to protected plugin functions, leading to limited confidentiality impact on affected WordPress sites.

Critical Impact
Unauthenticated attackers can bypass access control checks in WP Directory Kit versions up to 1.4.0, exposing plugin functionality that should be restricted to authorized users.

Affected Products

WPDirectoryKit WP Directory Kit plugin for WordPress
All versions from n/a through 1.4.0
WordPress installations using the wpdirectorykit plugin

Discovery Timeline

2025-09-26 - CVE-2025-60120 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60120

Vulnerability Analysis

The vulnerability stems from missing authorization checks within the WP Directory Kit plugin. Specific plugin endpoints or actions do not verify whether the requesting user holds the required capability or role before executing privileged operations. This class of flaw, tracked as [CWE-862] Missing Authorization, allows unauthenticated actors to interact with functionality intended for restricted access levels.

The issue affects the plugin's access control security level configuration. Certain handlers rely on client-side or misconfigured server-side checks, which attackers can circumvent by issuing crafted HTTP requests directly to plugin endpoints. The confidentiality impact is limited to information exposed through the affected functions, without direct integrity or availability consequences.

EPSS data indicates a low near-term exploitation probability, and no public proof-of-concept exploit is currently available.

Root Cause

The plugin fails to implement current_user_can() capability checks or nonce validation on protected actions. Access control decisions rely on incorrectly configured security levels that do not enforce authorization at the server level. Requests reaching vulnerable endpoints bypass intended role restrictions.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to the vulnerable WP Directory Kit endpoints on a target WordPress site. Because no privileges or user interaction are required, the attacker only needs network access to the target site. See the Patchstack Vulnerability Report for endpoint-specific technical details.

Detection Methods for CVE-2025-60120

Indicators of Compromise

Unexpected HTTP requests to admin-ajax.php or REST endpoints referencing wpdirectorykit actions from unauthenticated sessions
Access log entries showing WP Directory Kit endpoint invocations without prior authentication cookies
Unusual data enumeration patterns targeting directory listings managed by the plugin

Detection Strategies

Inventory WordPress installations and identify sites running WP Directory Kit versions 1.4.0 or earlier
Review web server access logs for requests to plugin-specific action handlers originating from unauthenticated clients
Monitor for anomalous request volumes or parameter tampering against WP Directory Kit endpoints

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized SIEM for correlation
Alert on repeated 200-status responses to plugin AJAX or REST endpoints from clients lacking session cookies
Track file and database changes tied to the WP Directory Kit plugin scope

How to Mitigate CVE-2025-60120

Immediate Actions Required

Identify all WordPress instances running WP Directory Kit at or below version 1.4.0
Update the plugin to a version above 1.4.0 once the vendor publishes a fix confirmed via the Patchstack Vulnerability Report
Restrict network access to WordPress administrative and plugin endpoints where feasible

Patch Information

WP Directory Kit versions through 1.4.0 are affected. Consult the vendor's plugin repository and the Patchstack advisory for the corrected release version and upgrade instructions. Apply the patched version across all affected sites and verify the plugin version after upgrade.

Workarounds

Deactivate and remove the WP Directory Kit plugin until a patched version is installed
Deploy a Web Application Firewall (WAF) rule to block unauthenticated requests to wpdirectorykit action handlers
Enforce IP allowlisting or authentication proxies in front of WordPress admin and AJAX endpoints

bash

# Example WP-CLI commands to inventory and disable the plugin
wp plugin list --name=wpdirectorykit --fields=name,status,version
wp plugin deactivate wpdirectorykit