CVE-2025-1506: Wp Social Login and Register Social Counter <= 3.1.0 - Cross-Site Request Forgery to Settings Update
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.0. This is due to missing or incorrect nonce validation on the counteraccesskeysetup() function. This makes it possible for unauthenticated attackers to update social login provider settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1506?
CVE-2025-1506 has a high severity rating due to its potential for Cross-Site Request Forgery attacks.
How do I fix CVE-2025-1506?
To fix CVE-2025-1506, update the Wp Social Login and Register Social Counter plugin to version 3.1.1 or later.
What versions are affected by CVE-2025-1506?
CVE-2025-1506 affects all versions of the Wp Social Login and Register Social Counter plugin up to and including 3.1.0.
What impact does CVE-2025-1506 have on my WordPress site?
CVE-2025-1506 could allow unauthorized actions to be performed on behalf of users without their consent.
What is Cross-Site Request Forgery in the context of CVE-2025-1506?
In the context of CVE-2025-1506, Cross-Site Request Forgery allows attackers to trick users into executing unwanted actions on a web application in which they are authenticated.