CVE-2025-13620

🗓️ 05 Dec 2025 10:57:55Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 26 Views🌐 WEB

WordPress plugin Wp Social Login and Register Social Counter up to 3.1.3 has missing authorization in REST endpoints, enabling cache tampering.

Reporter	Title	Published	Views	Family All 9
CNNVD	WordPress plugin Wp Social Login and Register Social Counter 安全漏洞	5 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-13620 Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering	5 Dec 202510:57	–	cvelist
EUVD	EUVD-2025-201405	5 Dec 202512:30	–	euvd
NVD	CVE-2025-13620	5 Dec 202511:15	–	nvd
Patchstack	WordPress Wp Social Login and Register Social Counter plugin <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering vulnerability	4 Dec 202523:32	–	patchstack
Positive Technologies	PT-2025-49240	5 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-13620	6 Dec 202511:56	–	redhatcve
Vulnrichment	CVE-2025-13620 Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering	5 Dec 202510:57	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (December 1, 2025 to December 7, 2025)	11 Dec 202517:00	–	wordfence

Vulners

Node

roxnor wp_social_login_and_register_social_counterRange≤3.1.3wordpress

[
  {
    "vendor": "roxnor",
    "product": "Wp Social Login and Register Social Counter",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.1.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/4fa205d7-61ce-4ab9-b532-fd0b46b0f6a0
plugins	www.plugins.trac.wordpress.org/changeset/3402340/wp-social/tags/3.1.4/inc/admin-rest-api.php
research	www.research.cleantalk.org/cve-2025-13620/

Parameter	Position	Path	Description	CWE
type	path	wslu/v1/check_cache/{type}	Unauthenticated access to clear or fetch cache via REST route with no permission checks.	CWE-862
type	path	wslu/v1/save_cache/{type}	Unauthenticated access to overwrite cache via REST route with no permission checks.	CWE-862

17 Jun 2026 08:34Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.15.3

EPSS0.00349

SSVC

CWE-862