The Wp Social Login and Register Social Counter plugin allows unauthenticated users to clear or overwrite the social counter cache because several REST routes are registered with an always‑true permission callback. This flaw means an attacker can manipulate the displayed social engagement metrics on a WordPress site without storing or executing malicious code. The impact is primarily a loss of integrity and potential reputational damage due to falsified social counts.

This issue affects the Wp Social Login and Register Social Counter plugin provided by roxnor, for all versions up to and including 3.1.3.

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending crafted REST requests to the affected endpoints (wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, wslu/v1/settings/clear_counter_cache) without any authentication or nonce verification. Because the flaw is purely an authorization bypass, privileged access is not required but any entity with network visibility to the REST API can tamper with the counter.