CVE-2025-68998: CSRF in Heateor Social Login

A successful CSRF attack could allow an attacker to manipulate user accounts within the Heateor Social Login plugin. This could involve changing social login settings, disconnecting existing social accounts, or even potentially gaining access to sensitive user data if the plugin interacts with other systems. The impact is amplified if the plugin is used in conjunction with other plugins or services that rely on the social login functionality, as the attacker could potentially leverage the CSRF to compromise those systems as well. While the CVSS score is medium, the potential for widespread impact across WordPress sites using this plugin warrants immediate attention.

1. Reserved2025-12-29
2. Published2025-12-30
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-68998 is to upgrade to a patched version of the Heateor Social Login plugin as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds such as adding CSRF tokens to all sensitive forms and actions within the plugin. Web Application Firewalls (WAFs) can also be configured to detect and block malicious CSRF requests. Monitor WordPress logs for suspicious activity, particularly requests originating from unfamiliar sources or exhibiting unusual patterns.

Active installs

1KNiche

Plugin rating