Unauthorized Access in Wp Social Login and Register Social Counter Plugin by WordPress

CVE-2025-13620

What is CVE-2025-13620?

The Wp Social Login and Register Social Counter plugin for WordPress is susceptible to a missing authorization vulnerability. This issue arises from the improper registration of REST routes, specifically wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache, with the permission callback set to __return_true. Consequently, this oversight allows unauthenticated attackers to exploit these endpoints, potentially clearing or modifying the social counter cache via crafted REST requests, posing a significant security risk.

References