CVE-2025-13620

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13620", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-24T20:43:17.834Z", "datePublished": "2025-12-05T10:57:55.576Z", "dateUpdated": "2026-04-08T16:52:07.449Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:07.449Z"}, "affected": [{"vendor": "roxnor", "product": "Wp Social Login and Register Social Counter", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests."}], "title": "Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa205d7-61ce-4ab9-b532-fd0b46b0f6a0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3402340/wp-social/tags/3.1.4/inc/admin-rest-api.php"}, {"url": "https://research.cleantalk.org/cve-2025-13620/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-11-24T20:59:48.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-04T21:44:40.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T12:21:45.363829Z", "id": "CVE-2025-13620", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T12:21:58.651Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13620", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T12:21:45.363829Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T12:21:54.929Z"}}], "cna": {"title": "Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "roxnor", "product": "Wp Social Login and Register Social Counter", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-24T20:59:48.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-04T21:44:40.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa205d7-61ce-4ab9-b532-fd0b46b0f6a0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3402340/wp-social/tags/3.1.4/inc/admin-rest-api.php"}, {"url": "https://research.cleantalk.org/cve-2025-13620/"}], "descriptions": [{"lang": "en", "value": "The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:07.449Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13620", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:52:07.449Z", "dateReserved": "2025-11-24T20:43:17.834Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-05T10:57:55.576Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Wp Social Login and Register Social Counter", "vendor": "roxnor", "versions": [{"lessThanOrEqual": "3.1.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests."}, {"lang": "es", "value": "El plugin de WordPress?Wp?Social?Login?and?Register?Social?Counter es vulnerable a la vulnerabilidad de falta de autorizaci\u00f3n en versiones hasta e incluyendo?3.1.3. Esto se debe a que las rutas REST?wslu/v1/check_cache/{type},?wslu/v1/save_cache/{type} y?wslu/v1/settings/clear_counter_cache se registran con?permission_callback?establecido en?__return_true?y carecen de validaci\u00f3n de capacidad o nonce en sus manejadores. Esto permite que atacantes?no autenticados borren o sobrescriban la cach\u00e9 del contador social mediante solicitudes?REST?fabricadas."}], "id": "CVE-2025-13620", "lastModified": "2026-10-18T15:10:00.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13620", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-05T12:21:45.363829Z", "version": "2.0.3"}}]}, "published": "2025-12-05T11:15:51.530", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3402340/wp-social/tags/3.1.4/inc/admin-rest-api.php"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-13620/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa205d7-61ce-4ab9-b532-fd0b46b0f6a0?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:41:26.349879+00:00", "value": {"mitigation_remediation": ["Upgrade Wp Social Login and Register Social Counter to version 3.1.4 or later, which removes the unauthenticated access to the relevant REST routes.", "If an immediate upgrade is not possible, block unauthenticated access to the affected REST endpoints by configuring your web server (e.g., .htaccess, nginx rules) or by using a security plugin to restrict these routes to authenticated users only.", "Enable monitoring of REST API traffic to detect unauthorized cache manipulation attempts, and review logs regularly for suspicious activity."], "summary": {"action": "Upgrade", "impact": "Social counter tampering via unauthenticated REST endpoints"}, "threat_synthesis": {"affected_systems": "This issue affects the Wp Social Login and Register Social Counter plugin provided by roxnor, for all versions up to and including 3.1.3.", "description_and_impact": "The Wp Social Login and Register Social Counter plugin allows unauthenticated users to clear or overwrite the social counter cache because several REST routes are registered with an always\u2011true permission callback. This flaw means an attacker can manipulate the displayed social engagement metrics on a WordPress site without storing or executing malicious code. The impact is primarily a loss of integrity and potential reputational damage due to falsified social counts.", "risk_and_exploitability": "The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending crafted REST requests to the affected endpoints (wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, wslu/v1/settings/clear_counter_cache) without any authentication or nonce verification. Because the flaw is purely an authorization bypass, privileged access is not required but any entity with network visibility to the REST API can tamper with the counter."}}}}, "created": "2025-12-05T20:56:25.552564+00:00", "updated": "2026-04-21T17:45:16.488873+00:00", "vendors": ["roxnor", "roxnor$PRODUCT$wp_social_login_and_register_social_counter", "wordpress", "wordpress$PRODUCT$wordpress"]}