CVE-2025-13737 is a CSRF vulnerability in the Nextend Social Login and Register WordPress plugin, affecting all versions up to and including 3.1.21. The issue arises from missing or incorrect nonce validation on the 'unlinkUser' function, enabling attackers to forge requests that cause administrators to unlink their social login accounts without their consent. The vulnerability requires user interaction (UI:R) and does not grant direct confidentiality or availability impact but allows integrity impact limited to unlinking social login.

An attacker can cause a site administrator to unlink their social login account by tricking them into clicking a malicious link or performing another action that sends a forged request. This results in an integrity impact limited to unlinking social login credentials. There is no direct confidentiality or availability impact reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, administrators should exercise caution when clicking on untrusted links and consider implementing additional CSRF protections or nonce validation manually if feasible. Monitor vendor channels for updates regarding an official fix.