Nextend Social Login and Register <= 3.1.21 - 跨站请求伪造 (Cross-Site Request Forgery) 用于取消关联用户社交登录

Successful exploitation of this CSRF vulnerability allows an attacker to force a site administrator to perform actions without their knowledge or consent. Specifically, an attacker can craft a malicious request that, when triggered (e.g., by clicking a link), will unlink a user's social login accounts. This can disrupt user access, potentially leading to frustration and impacting the user experience. While the direct impact is limited to account unlinking, it highlights a broader weakness in the plugin's security posture and could potentially be chained with other vulnerabilities for more severe consequences. The attack requires the administrator to interact with the malicious link, so social engineering is a key component of exploitation.

WordPress websites utilizing the Nextend Social Login and Register plugin, particularly those with site administrators who are susceptible to social engineering attacks, are at risk. Shared hosting environments where multiple websites share the same server resources may also be indirectly affected if one site is compromised and used to launch attacks against others.

• wordpress / composer / npm:

grep -r 'unlinkUser' /var/www/html/wp-content/plugins/nextend-social-login/

• wordpress / composer / npm:

wp plugin list --status=active | grep nextend-social-login

• wordpress / composer / npm:

wp plugin update nextend-social-login

• generic web: Inspect WordPress admin interface for suspicious links or forms related to social login unlinking. Check access logs for unusual requests to the plugin's unlink endpoint.

1. 2025-11-28Disclosure

   disclosure

活跃安装数

200K已知

插件评分

4.9

需要WordPress版本

4.9+

兼容至

6.9.4

需要PHP版本

7.4+

1. 已保留2025-11-26
2. 发布日期2025-11-28
3. 修改日期2026-04-08
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-13737 is to immediately upgrade the Nextend Social Login and Register plugin to version 3.1.22 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include restricting administrative access to the plugin's settings page, or implementing stricter input validation on the 'unlinkUser' function (though this requires custom code and careful testing). Monitor WordPress access logs for suspicious requests targeting the plugin's unlink functionality. After upgrading, verify the fix by attempting to trigger the unlink action with a forged request; it should be rejected due to proper nonce validation.