PT-2025-49240 · WordPress · Wp Social Login/Register Social Counter

Dmitry Ignatyev · Published 2025-12-05 · Updated 2025-12-05 · CVE-2025-13620

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wp Social Login and Register Social Counter plugin versions prior to 3.1.4

Description The Wp Social Login and Register Social Counter plugin for WordPress has an issue with missing authorization. REST routes including /wslu/v1/check cache/{type}, /wslu/v1/save cache/{type}, and /wslu/v1/settings/clear counter cache are registered without proper capability or nonce validation in their handlers. This allows unauthenticated attackers to clear or overwrite the social counter cache using crafted REST requests. The permission callback is set to return true, bypassing security checks.

Recommendations Update the Wp Social Login and Register Social Counter plugin to version 3.1.4 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13620

Affected Products

Wp Social Login/Register Social Counter

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13620 · Security Note
• https://plugins.trac.wordpress.org/changeset/3402340/wp-social/tags/3.1.4/inc/admin-rest-api.php · Note
• https://twitter.com/CVEnew/status/1996901392556929109 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1996981852813287801 · Twitter Post
• https://research.cleantalk.org/cve-2025-13620 · Note
• https://t.me/CVEtracker/38922 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4fa205d7-61ce-4ab9-b532-fd0b46b0f6a0?source=cve · Note
• https://t.me/cveNotify/144858 · Telegram Post