CVE-2025-13737: Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login
The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is due to missing or incorrect nonce validation on the 'unlinkUser' function. This makes it possible for unauthenticated attackers to unlink the user's social login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13737?
CVE-2025-13737 has been classified as a medium severity vulnerability due to its potential impact on user authentication.
How do I fix CVE-2025-13737?
To fix CVE-2025-13737, update the Nextend Social Login and Register plugin to version 3.1.22 or later.
What versions of Nextend Social Login and Register are affected by CVE-2025-13737?
CVE-2025-13737 affects all versions of Nextend Social Login and Register up to and including 3.1.21.
Can CVE-2025-13737 be exploited by authenticated users?
No, CVE-2025-13737 can be exploited by unauthenticated attackers due to insufficient nonce validation.
What kind of attack is associated with CVE-2025-13737?
CVE-2025-13737 is associated with Cross-Site Request Forgery (CSRF) attacks that can compromise user accounts.