CVE-2025-13620: fallo de gravedad media en roxnor Wp Social Login and Register Social…
Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.4%
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
roxnor · Wp Social Login and Register Social CounterCVEs relacionadas — roxnor Wp Social Login and Register Social…
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-9501CRITICALWp Social Login and Register Social Counter <= 3.0.7 - Authentication Bypass via WordPress.com OAuth providerEPSS 0.8%CVE-2026-103898HIGHWp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login CallbackEPSS 0.4%CVE-2024-1763MEDIUMWp Social Login and Register Social Counter <= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status UpdateEPSS 0.4%CVE-2025-1506MEDIUMWp Social Login and Register Social Counter <= 3.1.0 - Cross-Site Request Forgery to Settings UpdateEPSS 0.2%CVE-2026-97344MEDIUMWp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta WriteEPSS 0.2%