{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-04T14:10:05.774","vulnerabilities":[{"cve":{"id":"CVE-2025-34077","sourceIdentifier":"disclosure@vulncheck.com","published":"2025-07-09T01:15:49.780","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server."},{"lang":"es","value":"Existe una vulnerabilidad de omisión de autenticación en el complemento de WordPress Pie Register (versión ? 3.7.1.4) que permite a atacantes no autenticados suplantar la identidad de usuarios arbitrarios mediante el envío de una solicitud POST manipulada al endpoint de inicio de sesión. Al establecer social_site=true y manipular el parámetro user_id_social_site, un atacante puede generar una cookie de sesión de WordPress válida para cualquier ID de usuario, incluidos los administradores. Una vez autenticado, el atacante puede explotar la funcionalidad de carga del complemento para instalar un complemento malicioso con código PHP arbitrario, lo que provoca la ejecución remota de código en el servidor subyacente."}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/GTSolutions/Pie-Register","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_pie_register_bypass_rce.rb","source":"disclosure@vulncheck.com"},{"url":"https://pieregister.com/","source":"disclosure@vulncheck.com"},{"url":"https://vulncheck.com/advisories/wordpress-pie-register-plugin-rce","source":"disclosure@vulncheck.com"},{"url":"https://wordpress.org/plugins/pie-register/","source":"disclosure@vulncheck.com"},{"url":"https://www.exploit-db.com/exploits/50395","source":"disclosure@vulncheck.com"}]}}]}