Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

WordPress Pie Register plugin allows attackers to impersonate any user

CVE-2025-34077 · published 1 year ago
Summary

A security flaw in the WordPress Pie Register plugin allows hackers to pretend to be any user, including administrators, by sending a special request to the login page. This could lead to unauthorized access to sensitive areas of the website and potentially allow malicious code to be installed on the server. Update the plugin to the latest version (3.7.1.5 or later) to fix this issue.

Original advisory text
An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST reques...
An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
17% chance of attack within 30 days
Type
CWE-94Code Injection
CWE-306Missing Authentication for Critical Function
CWE-434Unrestricted File Upload
Timeline
Published9 Jul 2025
Updated1 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-34077 · NVD
Track software like this
Free during beta