Description
An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Genetech Solutions | WordPress Pie Register Plugin | ≤ 3.7.1.4 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
WordPress Plugin Pie Register Auth Bypass to RCE
exploit/unix/webapp/wp_pie_register_bypass_rce
Exploit-DB 1
- Pie Register WordPress Plugin 3.7.1.4 - Authentication Bypass to RCE EDB-52370 · webapps · Jul 22, 2025
GitHub 3 repositories
-
MrjHaxcore/CVE-2025-34077 ★ 6 · Jul 9, 2025
WordPress Pie Register ≤ 3.7.1.4 - Admin Privilege Escalation (Unauthenticated)
-
0xgh057r3c0n/CVE-2025-34077 ★ 3 · Jul 28, 2025
Poc for Unauthenticated Admin Session Hijack - Pie Register Plugin (≤ 3.7.1.4)
-
salimelh94/Web-Penetration-Test ★ 0 · Apr 9, 2026
Exploiting WordPress vulnerabilities (CVE-2025-34077), authentication bypass via cookie injection, and privilege escalation to root. Part of my Cybersecurity Specialization.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Pie Register <= 3.7.1.4 - Authentication Bypass http/cves/2025/CVE-2025-34077.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_pie_register_bypass_rce.rb exploit
- https://www.exploit-db.com/exploits/50395 exploit
- https://pieregister.com/ product
- https://github.com/GTSolutions/Pie-Register product
- https://wordpress.org/plugins/pie-register/ product
- https://vulncheck.com/advisories/wordpress-pie-register-plugin-rce third-party-advisory