Nextend Social Login and Register <= 3.1.21 - ユーザーのソーシャルログインを切り離すためのクロスサイトリクエストフォージェリ (Cross-Site Request Forgery)

Successful exploitation of this CSRF vulnerability allows an attacker to force a site administrator to perform actions without their knowledge or consent. Specifically, an attacker can craft a malicious request that, when triggered (e.g., by clicking a link), will unlink a user's social login accounts. This can disrupt user access, potentially leading to frustration and impacting the user experience. While the direct impact is limited to account unlinking, it highlights a broader weakness in the plugin's security posture and could potentially be chained with other vulnerabilities for more severe consequences. The attack requires the administrator to interact with the malicious link, so social engineering is a key component of exploitation.

WordPress websites utilizing the Nextend Social Login and Register plugin, particularly those with site administrators who are susceptible to social engineering attacks, are at risk. Shared hosting environments where multiple websites share the same server resources may also be indirectly affected if one site is compromised and used to launch attacks against others.

• wordpress / composer / npm:

grep -r 'unlinkUser' /var/www/html/wp-content/plugins/nextend-social-login/

• wordpress / composer / npm:

wp plugin list --status=active | grep nextend-social-login

• wordpress / composer / npm:

wp plugin update nextend-social-login

• generic web: Inspect WordPress admin interface for suspicious links or forms related to social login unlinking. Check access logs for unusual requests to the plugin's unlink endpoint.

1. 2025-11-28Disclosure

   disclosure

アクティブインストール数

200K既知

プラグイン評価

4.9

WordPressが必要

4.9+

動作確認済みバージョン

6.9.4

PHPが必要

7.4+

1. 予約済み2025-11-26
2. 公開日2025-11-28
3. 更新日2026-04-08
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-13737 is to immediately upgrade the Nextend Social Login and Register plugin to version 3.1.22 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include restricting administrative access to the plugin's settings page, or implementing stricter input validation on the 'unlinkUser' function (though this requires custom code and careful testing). Monitor WordPress access logs for suspicious requests targeting the plugin's unlink functionality. After upgrading, verify the fix by attempting to trigger the unlink action with a forged request; it should be rejected due to proper nonce validation.