CVE-2024-13182

Critical

Published: 13 February 2025

Published

13 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0004 13.7th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13182 is a critical-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Localhost:1337 (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, ranked at the 13.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Requires enforcement of approved authorizations for access to system resources, directly countering the plugin's incorrect authentication logic that bypasses validation.

SI-2 Flaw Remediation good match

prevent

Mandates timely remediation of identified flaws, such as patching the vulnerable WP Directorybox Manager plugin versions up to 2.5.

AC-6 Least Privilege partial match

prevent

Limits the damage from authentication bypass by enforcing least privilege on user accounts, reducing the impact of attacker access to administrative functions.

NVD Description

The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attackers to log in…

as any existing user on the site, such as an administrator.

Deeper analysisAI

CVE-2024-13182 is an authentication bypass vulnerability affecting the WP Directorybox Manager plugin for WordPress in all versions up to and including 2.5. The flaw arises from incorrect authentication logic in the 'wp_dp_parse_request' function, which allows unauthorized access without proper validation. Published on 2025-02-13, it is classified under CWE-288 (Authentication Improperly Specified) with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no privileges or user interaction required. Successful exploitation enables attackers to log in as any existing user on the site, such as an administrator, potentially granting full control over the WordPress installation.

Advisories, including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9e5e5d-a7fc-4159-a2ae-610bee76f818?source=cve, provide further details on the issue. A referenced code location at line 43 in wp-content/plugins/wp-directorybox-manager/elements/login/cs-social-login/cs-social-login.php highlights the authentication flaw in the social login component.