CVE-2025-13620: 
WordPress vulnerability analysis and mitigation

CVE-2025-13620 is a missing authorization vulnerability in the WP Social Login and Register Social Counter WordPress plugin (by Wpmet) affecting versions up to and including 3.1.3. The flaw allows unauthenticated attackers to clear or overwrite the plugin's social counter cache via crafted REST API requests. It was published on December 5, 2025, with a patch released in version 3.1.4. The CVSS v3.1 base score is 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization). Three REST API routes — wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache — are registered with permission_callback set to __return_true, which grants access to all requesters without any authentication check. The route handlers themselves also lack capability checks or nonce validation, meaning any unauthenticated network request can invoke these endpoints. The fix in version 3.1.4 addresses this by implementing proper authorization controls in inc/admin-rest-api.php (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to manipulate the social counter cache — either clearing it or overwriting it with arbitrary data — which undermines the integrity of social engagement metrics displayed on the affected WordPress site. There is no confidentiality or availability impact (no data exposure or service disruption), and the scope is limited to the plugin's cached data. While the direct impact is low, falsified social counters could be used for reputational manipulation or as part of a broader site defacement campaign (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only network access and no authentication, making it trivially easy to attempt, but the limited impact reduces attacker incentive (Wordfence).

1. Reconnaissance: Identify WordPress sites running the WP Social Login and Register Social Counter plugin (version ≤ 3.1.3) using tools like WPScan or by checking publicly accessible plugin metadata at /wp-content/plugins/wp-social/.
2. Identify vulnerable REST endpoints: Confirm the presence of the unprotected REST routes by sending a GET or POST request to https://target.com/wp-json/wslu/v1/check_cache/{type} and observing a valid (non-403) response.
3. Clear the social counter cache: Send an unauthenticated HTTP request to https://target.com/wp-json/wslu/v1/settings/clear_counter_cache to wipe cached social counter data.
4. Overwrite cached data: Send a crafted POST request to https://target.com/wp-json/wslu/v1/save_cache/{type} with a manipulated payload body to inject arbitrary values into the social counter cache, causing falsified metrics to be displayed on the site (Wordfence, WordPress Trac).

• Network: Unexpected unauthenticated HTTP requests (GET/POST) to WordPress REST API endpoints matching the patterns /wp-json/wslu/v1/check_cache/, /wp-json/wslu/v1/save_cache/, or /wp-json/wslu/v1/settings/clear_counter_cache from unknown or external IP addresses.
• Logs: WordPress access logs showing repeated REST API calls to the above endpoints without authentication headers or nonce tokens, particularly from automated/scripted sources (high request frequency, non-browser user agents).
• Application Behavior: Sudden unexplained changes or resets in social counter values displayed on the WordPress site, or social counters showing anomalous/inflated numbers inconsistent with actual engagement.

Update the WP Social Login and Register Social Counter plugin to version 3.1.4 or later, which introduces proper authorization checks on the affected REST API endpoints. No configuration-based workaround is available short of disabling the plugin entirely. Site administrators should also consider restricting access to the WordPress REST API for unauthenticated users via a security plugin or web application firewall rule as a defense-in-depth measure (Wordfence, WordPress Trac).

Sucuri included this vulnerability in their December 2025 vulnerability patch roundup, noting it as one of several WordPress plugin issues requiring attention (Sucuri Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure channels has been identified.