CVE-2025-13620: CWE-862 Missing Authorization in roxnor Wp Social Login and Register Social Counter
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests.
AI Analysis
Technical Summary
CVE-2025-13620 describes a missing authorization vulnerability in the roxnor Wp Social Login and Register Social Counter plugin for WordPress, affecting versions up to 3.1.3. The issue arises because certain REST API endpoints are registered with permission_callback set to __return_true, effectively bypassing any capability or nonce validation. This allows unauthenticated attackers to send crafted REST requests to clear or overwrite the social counter cache, impacting the integrity of cached social login data.
Potential Impact
The vulnerability allows unauthenticated attackers to manipulate the social counter cache by clearing or overwriting it via REST API calls. While it does not disclose sensitive data or allow privilege escalation, it impacts the integrity of the social counter cache, potentially disrupting expected plugin functionality or causing inaccurate social login metrics.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected REST API endpoints through web application firewall rules or other access controls to prevent unauthenticated requests. Monitor plugin updates from the vendor for an official patch.
CVE-2025-13620: CWE-862 Missing Authorization in roxnor Wp Social Login and Register Social Counter
Description
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-13620 describes a missing authorization vulnerability in the roxnor Wp Social Login and Register Social Counter plugin for WordPress, affecting versions up to 3.1.3. The issue arises because certain REST API endpoints are registered with permission_callback set to __return_true, effectively bypassing any capability or nonce validation. This allows unauthenticated attackers to send crafted REST requests to clear or overwrite the social counter cache, impacting the integrity of cached social login data.
Potential Impact
The vulnerability allows unauthenticated attackers to manipulate the social counter cache by clearing or overwriting it via REST API calls. While it does not disclose sensitive data or allow privilege escalation, it impacts the integrity of the social counter cache, potentially disrupting expected plugin functionality or causing inaccurate social login metrics.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected REST API endpoints through web application firewall rules or other access controls to prevent unauthenticated requests. Monitor plugin updates from the vendor for an official patch.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-11-24T20:43:17.834Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6932d3dff88dbe026cbce002
Added to database: 12/5/2025, 12:45:19 PM
Last enriched: 4/9/2026, 4:32:43 PM
Last updated: 5/8/2026, 7:48:39 AM
Views: 203
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.