CVE-2025-34077

An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.

• CWE-94
• CWE-306
• CWE-434

• https://github.com/GTSolutions/Pie-Register
• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_pie_register_bypass_rce.rb
• https://pieregister.com/
• https://vulncheck.com/advisories/wordpress-pie-register-plugin-rce
• https://wordpress.org/plugins/pie-register/
• https://www.exploit-db.com/exploits/50395

Published

Jul 9, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-34071A remote code execution vulnerability in GFI Kerio Control 9…9.8
• CVE-2025-34072A data exfiltration vulnerability exists in Anthropic’s depr…9.3
• CVE-2025-34073An unauthenticated command injection vulnerability exists in…10
• CVE-2025-34074An authenticated remote code execution vulnerability exists …9.4
• CVE-2025-34075Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-34076An authenticated local file inclusion vulnerability exists i…7.2
• CVE-2025-34078A local privilege escalation vulnerability exists in NSClien…7.8
• CVE-2025-34079An authenticated remote code execution vulnerability exists …7.8
• CVE-2025-3408A vulnerability was found in Nothings stb up to f056911. It …8.8
• CVE-2025-34080The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable…6.1
• CVE-2025-34081The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP…7.5
• CVE-2025-34082A command injection vulnerability exists in IGEL OS versions…9.3