CVE-2025-34077: Genetech Solutions WordPress Pie Register Plugin

Critical severity, CVSS 10.0. EPSS: 16.4% chance of exploitation in the next 30 days.

An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.

Affected products

• Genetech Solutions WordPress Pie Register Plugin: up to and including 3.7.1.4

Published 2025-07-09. Last modified 2026-06-17.