CVE-2025-13620: WordPress Social Login Auth Bypass Flaw

CVE-2025-13620 Overview

CVE-2025-13620 is a missing authorization vulnerability in the WP Social Login and Register Social Counter plugin for WordPress. The flaw affects all versions up to and including 3.1.3. Three REST API routes register their permission_callback as __return_true and omit capability or nonce checks in their handlers. Unauthenticated attackers can send crafted REST requests to clear or overwrite the plugin's social counter cache. The issue is tracked under CWE-862: Missing Authorization and carries an integrity impact but no confidentiality or availability impact.

Critical Impact
Unauthenticated remote attackers can tamper with the social counter cache on any affected WordPress site by calling exposed REST endpoints without credentials.

Affected Products

WP Social Login and Register Social Counter plugin for WordPress, versions <= 3.1.3
Fixed in version 3.1.4
WordPress installations running the vulnerable plugin

Discovery Timeline

2025-12-05 - CVE-2025-13620 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13620

Vulnerability Analysis

The plugin registers three REST routes under the wslu/v1 namespace: wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache. Each route declares permission_callback as __return_true, which unconditionally grants access to any caller. The route handlers also fail to validate WordPress capabilities or nonces before performing state-changing operations on the counter cache.

Because the vulnerable endpoints are exposed under the standard /wp-json/ prefix, any network-reachable client can invoke them. The impact is limited to integrity of the cached social counter data, which explains the low integrity impact and absence of confidentiality or availability effects. Site owners can see counter values overwritten or wiped, degrading trust in social proof widgets rendered by the plugin. See the Wordfence Vulnerability Report and the CleanTalk CVE Analysis for further context.

Root Cause

The root cause is an authorization control failure [CWE-862]. Using __return_true as the permission_callback disables the WordPress REST API access gate. Handlers additionally skip current_user_can() and wp_verify_nonce() checks that would normally enforce administrative context for cache-modifying actions.

Attack Vector

Exploitation is fully remote and requires no authentication or user interaction. An attacker crafts HTTP requests to the exposed REST endpoints, for example POST /wp-json/wslu/v1/settings/clear_counter_cache, to trigger cache clearing. Similar requests to save_cache/{type} allow overwriting cached counter values. The WordPress Plugin Change Log for version 3.1.4 shows the corrected permission callbacks.

Detection Methods for CVE-2025-13620

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-json/wslu/v1/check_cache/, /wp-json/wslu/v1/save_cache/, or /wp-json/wslu/v1/settings/clear_counter_cache
Sudden zeroing or unexpected changes in social counter values displayed by the plugin
Requests to these endpoints originating from IPs with no prior session cookies or authentication headers

Detection Strategies

Inspect web server access logs for requests matching the wslu/v1/ path prefix and correlate with authentication state
Alert on high-frequency or scripted access patterns targeting the vulnerable REST routes
Compare stored social counter values against expected baselines to identify tampering

Monitoring Recommendations

Enable WordPress REST API request logging via a security plugin or reverse proxy
Forward WordPress and web server logs to a centralized analytics platform for correlation
Review installed plugin versions across the fleet and flag any instance running wp-social at version <= 3.1.3

How to Mitigate CVE-2025-13620

Immediate Actions Required

Update the WP Social Login and Register Social Counter plugin to version 3.1.4 or later on all WordPress sites
Audit REST API logs for prior unauthenticated access to wslu/v1/ endpoints
Rebuild or verify social counter data if tampering is suspected

Patch Information

The vendor fixed the issue in version 3.1.4. The corrected code replaces __return_true with a proper permission callback that validates administrator capabilities. Details of the code change are visible in the WordPress Plugin Change Log.

Workarounds

Deactivate the plugin until the patched version can be installed
Restrict access to /wp-json/wslu/v1/ paths using a web application firewall or reverse proxy rule
Deny anonymous access to the WordPress REST API at the network edge where feasible

bash

# Example NGINX rule to block anonymous access to the vulnerable endpoints
location ~ ^/wp-json/wslu/v1/ {
    deny all;
    return 403;
}