CVE-2025-34077

CVE-2025-34077 — WordPress Pie Register ≤ 3.7.1.4 - 管理员权限提升（未认证） 💀 作者 Mrj Haxcore 🧠 漏洞摘要 WordPress 的 Pie Register 插件（版本 ≤ 3.7.1.4）暴露了一个未认证的端点，攻击者只需 POST 一个特定的负载即可 劫持管理员会话 。 利用该漏洞可 窃取用户 ID 1 （通常为 admin）的会话 cookies，无需任何登录凭据。 📦 受影响软件 插件名称：Pie Register 版本： wordpressloggedinxxxxxx = ! 请在浏览器或 curl、Burp...

WordPress Pie Register <3.8.2.3 - Open Redirect

WordPress Pie Register plugin before 3.8.2.3 contains an open redirect vulnerability. The plugin does not properly validate the redirection URL when logging in and login out. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute...

WordPress Pie Register <3.7.0.1 - Cross-Site Scripting

WordPress Pie Register plugin before 3.7.0.1 is susceptible to cross-site scripting. The plugin does not sanitize the invitaioncode GET parameter when outputting it in the Activation Code page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login

The Registration Forms User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username...

WordPress Pie-Register <2.0.19 - Cross-Site Scripting

WordPress Pie Register before 2.0.19 contains a reflected cross-site scripting vulnerability in pie-register/pie-register.php which allows remote attackers to inject arbitrary web script or HTML via the invitaioncode parameter in a pie-register page to the default URL. id: CVE-2015-7377 info: nam...

WordPress Pie Register <= 3.7.1.4 - Authentication Bypass

An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting socialsite=true and manipulating the useridsocialsite parameter,...

CVE-2021-24647

CVE-2021-24647 CVE-2021-24647 Pie Register 3.7.1.6 - 非认证任意登录 信息 usage: exploit.py -h -w URL -p PATH options: -h, --help show this help message and exit -w URL, --url URL URL of the WordPress site -p PATH, --path PATH Path of the Login Page /login/ or /pie-registration/ 使用方法 $ python3 exploit.py -...

CVE-2026-96962

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

CVE-2026-96962

The Pie Register WordPress plugin (versions prior to 3.8.4.14 ) contains a vulnerability where it fails to restrict access to an invitation-code report . This flaw allows unauthenticated visitors to obtain the usernames and email addresses of all users who registered using a specific, known invit...

CVE-2026-96962 Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

CVE-2026-96962 Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

EUVD-2026-91949

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

PT-2026-104535

Name of the Vulnerable Software and Affected Versions The Pie Register WordPress plugin versions prior to 3.8.4.14 Description The plugin fails to restrict access to an invitation-code report. This allows unauthenticated visitors who possess a valid invitation code to retrieve the usernames and...

Web-Penetration-Test

Web-Penetration-Test 利用 WordPress 漏洞（CVE-2025-34077），通过 Cookie 注入绕过身份验证，并提权至 root。这是我网络安全专业化课程的一部分。 第一天：入侵我的第一个网站 实验报告：入侵“BigWear”服务器 在网络安全之旅的第一节课中，我摒弃了那些神话。我认识到，要发现安全漏洞，你不需要是数学天才或专业程序员；你需要的是创造力、逻辑和一套扎实的方法论。 分步解析：“BigWear”服务器失陷过程 我把“BigWear”服务器比作一栋办公楼，而我的目标是抵达保险库。以下是我遵循的逻辑流程： 第一步：敲门侦察（扫描）...

CVE-2026-103345

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

EUVD-2026-90801

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

CVE-2026-103345 WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

CVE-2026-103345 WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

CVE-2026-103345

The Pie Register WordPress plugin (versions

WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pie Register versions = 3.8.4.13...