PT-2025-51811 · WordPress · Wp Social Ninja

Angus Girvan · Published 2025-12-17 · Updated 2025-12-17 · CVE-2025-13880

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) versions prior to 4.0.2

Description The WP Social Ninja plugin for WordPress is susceptible to unauthorized access and modification of data. This is due to a missing capability check within the getAdvanceSettings and saveAdvanceSettings functions. An unauthenticated attacker can view and modify the plugin’s advanced settings.

Recommendations Update to version 4.0.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13880

Affected Products

Wp Social Ninja

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-13880 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8b8e3cb9-00b3-4500-adf0-c8a9fbf9d546?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-social-reviews/tags/4.0.1/app/Services/PermissionManager.php#L176 · Note
• https://plugins.trac.wordpress.org/browser/wp-social-reviews/tags/4.0.1/app/Http/Controllers/SettingsController.php#L144 · Note
• https://t.me/CVEtracker/40031 · Telegram Post
• https://twitter.com/CVEnew/status/2001350824371667206 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-social-reviews/tags/4.0.1/app/Http/Policies/SettingsPolicy.php#L14 · Note
• https://plugins.trac.wordpress.org/browser/wp-social-reviews/tags/4.0.1/app/Http/Routes/api.php#L44 · Note
• https://t.me/cveNotify/146054 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2001191169284345895 · Twitter Post