1## autogenerated on 2026-04-01 15:25:36
2name: crowdsecurity/vpatch-CVE-2025-13920
3description: 'Detects unauthenticated email exposure in WP Directory Kit via wdk_public_action AJAX handler.'
4rules:
5  - and:
6      - zones:
7          - URI
8        transform:
9          - lowercase
10        match:
11          type: equals
12          value: /wp-admin/admin-ajax.php
13      - zones:
14          - BODY_ARGS
15        variables:
16          - action
17        transform:
18          - lowercase
19        match:
20          type: equals
21          value: wdk_public_action
22      - zones:
23          - BODY_ARGS
24        variables:
25          - print_column
26        transform:
27          - lowercase
28        match:
29          type: equals
30          value: user_email
31
32labels:
33  type: exploit
34  service: http
35  confidence: 3
36  spoofable: 0
37  behavior: 'http:exploit'
38  label: 'WP Directory Kit - Exposure'
39  classification:
40    - cve.CVE-2025-13920
41    - attack.T1592
42    - cwe.CWE-862
43