CVE-2025-0316
📋 TL;DR
The WP Directorybox Manager plugin for WordPress has an authentication bypass vulnerability that allows unauthenticated attackers to log in as any existing user, including administrators, if they know the username. This affects all WordPress sites using vulnerable versions of the plugin. Attackers can gain full administrative control of affected websites.
💻 Affected Systems
- WP Directorybox Manager WordPress Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover with administrative privileges, allowing data theft, defacement, malware injection, and backdoor installation.
Likely Case
Administrative account compromise leading to site modification, data exfiltration, or ransomware deployment.
If Mitigated
Limited impact if strong network controls, WAF rules, and monitoring prevent exploitation attempts.
🎯 Exploit Status
The vulnerability requires only username knowledge and can be exploited via simple HTTP requests to the vulnerable callback function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.6 or later
Vendor Advisory: https://themeforest.net/item/directory-multipurpose-wordpress-theme/10480929
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Directorybox Manager. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and delete the plugin immediately.
🔧 Temporary Workarounds
Plugin Deactivation
linuxTemporarily disable the vulnerable plugin to prevent exploitation
wp plugin deactivate wp-directorybox-manager
WAF Rule Implementation
allBlock requests to the vulnerable callback function using web application firewall rules
🧯 If You Can't Patch
- Immediately deactivate and remove the WP Directorybox Manager plugin from all WordPress installations
- Implement strict network access controls and web application firewall rules to block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for WP Directorybox Manager version 2.5 or earlierCheck Version:
wp plugin get wp-directorybox-manager --field=versionVerify Fix Applied:
Verify plugin version is 2.6 or later, or confirm plugin is completely removed from the plugins directory📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts to /wp-admin/admin-ajax.php with action=wp_dp_enquiry_agent_contact_form_submit_callback
- Multiple failed login attempts followed by successful login from same IP
- Administrative actions from previously inactive user accounts
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with the vulnerable callback parameter
- Unusual traffic patterns to WordPress admin endpoints
SIEM Query:
source="wordpress.log" AND ("wp_dp_enquiry_agent_contact_form_submit_callback" OR "admin-ajax.php" AND "action=wp_dp")