CVE-2025-13737

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13737", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-26T07:00:24.096Z", "datePublished": "2025-11-28T03:27:06.477Z", "dateUpdated": "2026-04-08T17:11:26.663Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:26.663Z"}, "affected": [{"vendor": "nextendweb", "product": "Nextend Social Login and Register", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.21", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is due to missing or incorrect nonce validation on the 'unlinkUser' function. This makes it possible for unauthenticated attackers to unlink the user's social login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6b747e-d267-4fd3-a4fd-022aa657c796?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/nextend-facebook-connect/tags/3.1.21/includes/provider.php#L772"}, {"url": "https://plugins.trac.wordpress.org/changeset/3404174/nextend-facebook-connect/trunk/includes/provider.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "timeline": [{"time": "2025-11-26T07:16:19.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-27T14:54:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-28T14:57:28.840803Z", "id": "CVE-2025-13737", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-28T14:57:36.413Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13737", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-28T14:57:28.840803Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-28T14:57:33.344Z"}}], "cna": {"title": "Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login", "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "nextendweb", "product": "Nextend Social Login and Register", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.21"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-26T07:16:19.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-27T14:54:41.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6b747e-d267-4fd3-a4fd-022aa657c796?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/nextend-facebook-connect/tags/3.1.21/includes/provider.php#L772"}, {"url": "https://plugins.trac.wordpress.org/changeset/3404174/nextend-facebook-connect/trunk/includes/provider.php"}], "descriptions": [{"lang": "en", "value": "The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is due to missing or incorrect nonce validation on the 'unlinkUser' function. This makes it possible for unauthenticated attackers to unlink the user's social login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:26.663Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13737", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:11:26.663Z", "dateReserved": "2025-11-26T07:00:24.096Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-28T03:27:06.477Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Nextend Social Login and Register", "vendor": "nextendweb", "versions": [{"lessThanOrEqual": "3.1.21", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is due to missing or incorrect nonce validation on the 'unlinkUser' function. This makes it possible for unauthenticated attackers to unlink the user's social login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Nextend Social Login and Register para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 3.1.21, inclusive. Esto se debe a la validaci\u00f3n de nonce faltante o incorrecta en la funci\u00f3n 'unlinkUser'. Esto hace posible que atacantes no autenticados desvinculen el inicio de sesi\u00f3n social del usuario a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-13737", "lastModified": "2026-10-08T10:10:00.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13737", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-28T14:57:28.840803Z", "version": "2.0.3"}}]}, "published": "2025-11-28T04:16:00.010", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/nextend-facebook-connect/tags/3.1.21/includes/provider.php#L772"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3404174/nextend-facebook-connect/trunk/includes/provider.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6b747e-d267-4fd3-a4fd-022aa657c796?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:55:05.527584+00:00", "value": {"mitigation_remediation": ["Upgrade Nextend Social Login and Register to the latest patched version (\u22653.1.22).", "If an immediate upgrade is not feasible, add proper nonce validation to the unlinkUser endpoint so that the request is tied to the user\u2019s session and cannot be forged.", "Enforce role\u2011based access control by restricting unlinking functionality to administrators only and monitor for unusual unlink requests."], "summary": {"action": "Update Plugin", "impact": "Authentication Bypass \u2013 Unlinking social account"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the plugin Nextend Social Login and Register developed by Nextendweb. All plugin releases up to and including version 3.1.21 are impacted. No other vendor or product is listed.", "description_and_impact": "The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross\u2011Site Request Forgery (CWE\u2011352) because the unlinkUser function does not properly validate the nonce. This flaw allows an attacker, without prior authentication, to force an administrator into unlinking a user\u2019s social login by tricking them into clicking a malicious link or loading a crafted page. As a result, the targeted account can lose its social authentication method, potentially locking the user out or exposing the account to credential takeover. The vulnerability does not allow code execution or direct data exfiltration, but it undermines account integrity and may facilitate targeted denial of service on user access.", "risk_and_exploitability": "The CVSS score of 4.3 indicates medium severity. The EPSS score of less than 1% reflects a very low probability of exploitation at the time of analysis, and the issue is not yet listed in CISA\u2019s Known Exploited Vulnerabilities catalog. Exploitation requires no special privileges; the attacker only needs to craft and deliver a forged request that an administrator will unknowingly submit, typically via a malicious link or embedded resource. Because the flaw is a CSRF weakness, the likelihood of successful exploitation depends primarily on user education and the presence of additional CSRF defenses."}}}}, "created": "2025-11-28T08:51:09.584216+00:00", "updated": "2026-04-21T18:00:11.734861+00:00", "vendors": ["nextendweb", "nextendweb$PRODUCT$nextend_social_login", "wordpress", "wordpress$PRODUCT$wordpress"]}