What’s Vulnerable › Vulnerabilities
CVE-2025-34077: WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCE
- Severity: critical (CVSS 10.0 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 16.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-07-09 · updated 2026-06-17
- Weakness: CWE-94
Description
An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.
Affected products
- Genetech Solutions WordPress Pie Register Plugin: through 3.7.1.4
References
- https://github.com/GTSolutions/Pie-Register
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_pie_register_bypass_rce.rb
- https://pieregister.com/
- https://vulncheck.com/advisories/wordpress-pie-register-plugin-rce
- https://wordpress.org/plugins/pie-register/
- https://www.exploit-db.com/exploits/50395
Get alerted when CVE-2025-34077 or the next vulnerability affects your stack