The Wp Social Login and Register Social Counter plugin for WordPress contains a CSRF vulnerability (CWE-352) due to improper nonce validation in the counter_access_key_setup() function. This flaw enables unauthenticated attackers to modify social login provider settings by exploiting the trust of an authenticated site administrator who is tricked into executing a forged request. The vulnerability affects all versions up to 3.1.0 and has been assigned CVE-2025-1506 with a CVSS 3.1 base score of 4.3, indicating medium severity. There are no known exploits in the wild and no vendor-provided patch or remediation details at this time.

An attacker can cause an authenticated administrator to unknowingly update social login provider settings via a forged request, potentially altering site configuration. The vulnerability does not impact confidentiality or availability but can lead to integrity issues by unauthorized modification of settings. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or content that could trigger such requests. Monitoring vendor channels for updates is recommended.