Cross-Site Request Forgery Vulnerability in Wp Social Login and Register Social Counter Plugin by WordPress
CVE-2025-1506

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
WP Social Login And Register Social Counter
Vendor
CVE Published:
28 February 2025

What is CVE-2025-1506?

The Wp Social Login and Register Social Counter plugin for WordPress is susceptible to Cross-Site Request Forgery, affecting all versions up to 3.1.0. This vulnerability arises from improper nonce validation in the counter_access_key_setup() function, allowing unauthenticated attackers to manipulate social login provider settings through forged requests. By tricking a site administrator into performing specific actions, such as clicking on a misleading link, an attacker may exploit this weakness, compromising site settings and potentially endangering user accounts.

Affected Version(s)

Wp Social Login and Register Social Counter 0 <= 3.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3246155/wp-s...
https://plugins.trac.wordpress.org/browser/wp-social/tags...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Mungai
.