CVE-2025-13737 Overview
CVE-2025-13737 affects the Nextend Social Login and Register plugin for WordPress in all versions up to and including 3.1.21. The vulnerability is a Cross-Site Request Forgery (CSRF) weakness caused by missing or incorrect nonce validation in the unlinkUser function. Unauthenticated attackers can unlink a user's social login by tricking a site administrator into clicking a crafted link. The flaw is tracked as [CWE-352] and requires user interaction to succeed.
Critical Impact
Attackers can force administrators to unlink social login accounts through forged requests, disrupting authentication workflows for affected WordPress sites.
Affected Products
- Nextend Social Login and Register plugin for WordPress
- All versions up to and including 3.1.21
- WordPress sites with the vulnerable provider.php component
Discovery Timeline
- 2025-11-28 - CVE-2025-13737 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13737
Vulnerability Analysis
The vulnerability resides in the unlinkUser function within the Nextend Social Login and Register plugin's provider.php file. WordPress plugins are expected to use nonces to validate the authenticity of state-changing requests. This plugin fails to properly implement or verify a nonce token before executing the account unlink action. As a result, the plugin cannot distinguish between a legitimate administrator-initiated request and one triggered by a malicious cross-origin request.
The issue is classified under [CWE-352] Cross-Site Request Forgery. Successful exploitation requires the target administrator to be authenticated to WordPress and to interact with attacker-controlled content, such as clicking a link or visiting a malicious page.
Root Cause
The root cause is the absence of a valid nonce check in the unlinkUser handler. WordPress provides functions like wp_verify_nonce() and check_admin_referer() to bind requests to a user session, but these controls are either missing or improperly applied in the affected code path at line 772 of provider.php in version 3.1.21.
Attack Vector
The attack vector is network-based with required user interaction. An attacker hosts a page containing a forged HTTP request targeting the vulnerable endpoint. When an authenticated site administrator loads the page or clicks the crafted link, the browser submits the request with the administrator's session cookies. The plugin processes the request and unlinks the associated social login account. No authentication credentials or elevated privileges are required from the attacker.
See the WordPress Plugin Code Snippet and the Wordfence Vulnerability Analysis for technical details on the affected function.
Detection Methods for CVE-2025-13737
Indicators of Compromise
- Unexpected unlink events in WordPress user metadata for social login providers
- HTTP referer headers pointing to external, untrusted domains preceding unlink requests
- Administrator sessions generating requests to the Nextend plugin endpoint shortly after visiting third-party links
Detection Strategies
- Monitor WordPress audit logs for calls to the unlinkUser function without an accompanying nonce parameter
- Inspect web server access logs for POST or GET requests to Nextend plugin endpoints originating from cross-origin referers
- Alert on repeated social login unlink events across multiple accounts within short time windows
Monitoring Recommendations
- Deploy a WordPress activity logging plugin to capture authentication and account linkage changes
- Correlate administrator browser activity with unlink events using web application firewall (WAF) telemetry
- Track plugin version inventory across WordPress deployments to identify hosts running 3.1.21 or earlier
How to Mitigate CVE-2025-13737
Immediate Actions Required
- Update the Nextend Social Login and Register plugin to a version newer than 3.1.21 that includes the nonce validation fix
- Audit administrator accounts for unauthorized social login unlink events
- Restrict administrator browsing habits and enforce separate accounts for administrative and general web use
Patch Information
The vendor addressed the issue in a subsequent release. Review the WordPress Plugin Changeset for the specific code change that introduces proper nonce validation in the unlinkUser function. Apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Temporarily deactivate the Nextend Social Login and Register plugin until the patched version is installed
- Deploy a web application firewall rule blocking cross-origin POST requests to the plugin's unlink endpoint
- Require administrators to use dedicated browsers or browser profiles isolated from general browsing activity
# Update the plugin via WP-CLI
wp plugin update nextend-facebook-connect
# Verify installed version
wp plugin get nextend-facebook-connect --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
