CVE-2025-13920 is a medium-severity vulnerability in the WP Directory Kit WordPress plugin, affecting all versions up to 1.4.9. It arises from improper access control in the wdk_public_action AJAX handler, which permits unauthenticated attackers to retrieve email addresses of users with Directory Kit-specific roles. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact (disclosure of email addresses). No known exploits are reported in the wild. No official patch or remediation information is currently available.

The vulnerability allows unauthorized disclosure of user email addresses associated with Directory Kit-specific roles. This exposure can lead to privacy violations and potentially facilitate targeted phishing or social engineering attacks. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the AJAX handler or disabling the WP Directory Kit plugin if email confidentiality is critical. Monitor vendor channels for updates and apply patches promptly once available.