CVE-2025-13620: falha de média gravidade em roxnor Wp Social Login and Register Social…
Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
roxnor · Wp Social Login and Register Social CounterCVEs relacionadas — roxnor Wp Social Login and Register Social…
No mesmo produto, das mais perigosas para as menos.
CVE-2024-9501CRITICALWp Social Login and Register Social Counter <= 3.0.7 - Authentication Bypass via WordPress.com OAuth providerEPSS 0.8%CVE-2026-103898HIGHWp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login CallbackEPSS 0.4%CVE-2024-1763MEDIUMWp Social Login and Register Social Counter <= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status UpdateEPSS 0.4%CVE-2025-1506MEDIUMWp Social Login and Register Social Counter <= 3.1.0 - Cross-Site Request Forgery to Settings UpdateEPSS 0.2%CVE-2026-97344MEDIUMWp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta WriteEPSS 0.2%