Security Alert Summary
The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin for WordPress contains a vulnerability that allows unauthenticated attackers to view and modify the plugin’s advanced settings due to a missing capability check in specific functions. The issue affects all versions up to and including 4.0.1.
CVE Details
- CVE ID: CVE-2025-13880
- Affected plugin / component: WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin for WordPress
- Affected versions: All versions up to, and including, 4.0.1
- Published: December 17, 2025 at 5:16:11 AM UTC
- Last modified: December 17, 2025 at 5:16:11 AM UTC
- CVSS v3.1: Base Score 6.5, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Authentication / Privileges / User Interaction: Privileges Required: NONE; User Interaction: NONE; Attack Vector: NETWORK; Attack Complexity: LOW; Scope: UNCHANGED
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-862
Technical Details
The vulnerability exists because the getAdvanceSettings and saveAdvanceSettings functions in the plugin do not perform a required capability check. With the missing check, these functions can be invoked in a way that allows unauthenticated users to read and modify the plugin’s advanced settings.
The CVE description specifically identifies the lack of a capability check on those two functions as the root cause. The practical effect is limited to the plugin’s settings — attackers can view and alter advanced configuration values the plugin stores or exposes through its code paths that call these functions.
How This Could Impact Your Website
Consider a small organization where a site owner installs WP Social Ninja and several staff members and a contractor have different roles for managing content. An unauthenticated actor exploiting this vulnerability could access or change the plugin’s advanced settings without logging in. Depending on what settings are exposed, this could reveal configuration details or change how social feeds and reviews are displayed or fetched.
Practical consequences may include exposure of internal configuration data or email addresses stored in plugin settings, and increased risk of targeted phishing or social engineering if attacker-controlled settings reveal or redirect external content. The impact described in the CVSS scoring is limited to confidentiality (LOW) and integrity (LOW); availability of the site is not indicated as affected.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributor-level accounts and accounts used by third parties.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site and plugin activity logs for unusual changes to settings or unexpected API calls.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/wp-social-reviews/tags/4.0.1/app/Http/Controllers/SettingsController.php#L144
- https://plugins.trac.wordpress.org/browser/wp-social-reviews/tags/4.0.1/app/Http/Policies/SettingsPolicy.php#L14
- https://plugins.trac.wordpress.org/browser/wp-social-reviews/tags/4.0.1/app/Http/Routes/api.php#L44
- https://plugins.trac.wordpress.org/browser/wp-social-reviews/tags/4.0.1/app/Services/PermissionManager.php#L176
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8b8e3cb9-00b3-4500-adf0-c8a9fbf9d546?source=cve
