CVE-2024-13182 is an authentication bypass vulnerability in the WP Directorybox Manager WordPress plugin affecting all versions up to 2.5. The issue is due to incorrect authentication logic in the 'wp_dp_parse_request' function, which can be exploited by unauthenticated attackers to gain access as any existing user, including administrators. This vulnerability is critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. There is no patch or official fix available at this time, and the plugin is not a cloud service, so remediation depends on vendor updates or manual mitigation.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and log in as any user on the affected WordPress site, including administrators. This can lead to full site compromise, data theft, data modification, and denial of service. The vulnerability has a critical severity rating with a CVSS score of 9.8, indicating a high likelihood of severe impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released by Chimpstudio, users should consider disabling or removing the WP Directorybox Manager plugin to prevent exploitation. Monitor vendor channels for updates and apply patches immediately once available. No vendor advisory or official patch links are currently provided.