The Wp Social Login and Register Social Counter WordPress plugin contains a CSRF vulnerability (CWE-352) that allows an unauthenticated attacker to change the social login provider configuration. The flaw stems from missing or incorrect nonce validation in the counter_access_key_setup function. By crafting a forged request and luring an administrator into clicking a link, the attacker can submit new settings, potentially taking control of social authentication flows and redirecting users to malicious endpoints.

The vulnerability affects all releases of the Wp Social Login and Register Social Counter plugin up through version 3.1.0. WordPress sites that have installed this plugin, whether at default settings or with custom provider configurations, are at risk. Administrators and site owners of any WordPress deployment running these vulnerable plugin versions should be aware that an attacker can alter provider settings without authentication.

With a CVSS score of 4.3 the vulnerability is considered moderate. The EPSS score of less than 1% indicates a low probability of exploitation. The attack requires social engineering to get a site administrator to click a crafted link, thus the feasibility is limited but still present. The vulnerability is not listed in the CISA KEV catalog. The improper nonce handling makes the attack straightforward for a determined attacker who can target sites with the plugin.