WordPress Plugin Wp Social Login Missing Authorization Cache Override (CVE-2025-13620)

Vulnerability Overview CVE ID: CVE-2025-13620 Vulnerability Type: Missing Authorization / Improper Authorization Description: This vulnerability exists in the WordPress plugin "Wp Social Login and Register Social Counter". Multiple REST API routes are exposed without authentication. These routes are registered by handlers where the is set to . These handlers perform cache operations that modify state without any capability checks or nonce verification. Impact: An unauthenticated attacker can clear and overwrite the plugin's cached social count values (specifically for Instagram). This directly affects frontend widget output and can be abused to display incorrect follower counts or disrupt the counting functionality. Scope of Impact Affected Plugin Versions: Wp Social Login and Register Social Counter <= 3.1.3 Active Installations: 70,000+ Affected Routes: Exploitation Conditions: The vulnerability can be exploited by an attacker without logging in. POC Code Remediation 1. Core Fix: Treat these routes as privileged since they affect frontend output. 2. Specific Recommendations: At a minimum, the plugin should replace with a meaningful callback (e.g., an administrator-level capability like , or a plugin-specific capability). Validate request intent; for actions initiated by WordPress administrators, use nonces. This aligns with general WordPress REST guidelines, which state that permission callbacks should reflect the actual access level of the route. 3. Mitigation:** For site owners, the immediate defensive measure is to update to a version containing the authorization fix (3.1.4), or temporarily disable the plugin or block the vulnerable REST routes at the edge (WAF/CDN).

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Plugin Wp Social Login Missing Authorization Cache Override (CVE-2025-13620)