CVE-2025-34077

CVE-2025-34077 — WordPress Pie Register ≤ 3.7.1.4 - 관리자 권한 상승 인증 없음 💀 작성자 Mrj Haxcore 🧠 취약점 요약 WordPress용 Pie Register 플러그인버전 ≤ 3.7.1.4은 인증되지 않은 엔드포인트를 노출하여 공격자가 특정 페이로드를 POST하는 것만으로 관리자 세션을 가로챌 수 있습니다. 익스플로잇 결과, 로그인 자격 증명 없이 사용자 ID 1보통admin의 세션 쿠키를 탈취할 수 있습니다. 📦 영향을 받는 소프트웨어 플러그인 이름: Pie Registe...

WordPress Pie Register <3.8.2.3 - Open Redirect

WordPress Pie Register plugin before 3.8.2.3 contains an open redirect vulnerability. The plugin does not properly validate the redirection URL when logging in and login out. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute...

WordPress Pie Register <3.7.0.1 - Cross-Site Scripting

WordPress Pie Register plugin before 3.7.0.1 is susceptible to cross-site scripting. The plugin does not sanitize the invitaioncode GET parameter when outputting it in the Activation Code page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login

The Registration Forms User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username...

WordPress Pie-Register <2.0.19 - Cross-Site Scripting

WordPress Pie Register before 2.0.19 contains a reflected cross-site scripting vulnerability in pie-register/pie-register.php which allows remote attackers to inject arbitrary web script or HTML via the invitaioncode parameter in a pie-register page to the default URL. id: CVE-2015-7377 info: nam...

WordPress Pie Register <= 3.7.1.4 - Authentication Bypass

An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting socialsite=true and manipulating the useridsocialsite parameter,...

CVE-2021-24647

CVE-2021-24647 CVE-2021-24647 Pie Register 3.7.1.6 - 인증되지 않은 임의 로그인 정보 usage: exploit.py -h -w URL -p PATH options: -h, --help show this help message and exit -w URL, --url URL URL of the WordPress site -p PATH, --path PATH Path of the Login Page /login/ or /pie-registration/ 사용 방법 $ python3...

CVE-2026-96962

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

CVE-2026-96962

The Pie Register WordPress plugin (versions prior to 3.8.4.14 ) contains a vulnerability where it fails to restrict access to an invitation-code report . This flaw allows unauthenticated visitors to obtain the usernames and email addresses of all users who registered using a specific, known invit...

CVE-2026-96962 Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

CVE-2026-96962 Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

EUVD-2026-91949

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

PT-2026-104535

Name of the Vulnerable Software and Affected Versions The Pie Register WordPress plugin versions prior to 3.8.4.14 Description The plugin fails to restrict access to an invitation-code report. This allows unauthenticated visitors who possess a valid invitation code to retrieve the usernames and...

Web-Penetration-Test

Web-Penetration-Test WordPress の脆弱性 CVE-2025-34077 の悪用、Cookie インジェクションによる認証バイパス、root への権限昇格。サイバーセキュリティ専門コースの一環として実施。 Day 1: 初めての Web サイトをハッキング ラボレポート: 「BigWear」サーバーの悪用 サイバーセキュリティへの旅の最初のセッションで、私は神話から離れることができました。セキュリティの欠陥を特定するのに数学の天才や熟練プログラマーである必要はないと学びました。必要なのは創造性、論理的思考、そして確固たる方法論 です。 ステップバイステップ:...

CVE-2026-103345

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

EUVD-2026-90801

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

CVE-2026-103345 WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

CVE-2026-103345 WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

CVE-2026-103345

The Pie Register WordPress plugin (versions

WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pie Register versions = 3.8.4.13...