CVE-2025-34077

Unauthenticated Admin Session Hijack - Pie Register Plugin (≤ 3.7.1.4)

📌 Description

This exploit targets a vulnerability in the Pie Register WordPress plugin (versions ≤ 3.7.1.4), allowing unauthenticated session hijacking of admin accounts.

🛡️ This tool is for authorized testing and research only. Do not use it on systems you do not own or have explicit permission to test.

🧪 Proof of Concept

🚀 Usage

python3 CVE-2025-34077.py http://target.site

Example:

python3 CVE-2025-34077.py http://example.com

✅ Features

• Sends crafted POST payload to target site
• Extracts valid Set-Cookie values from unauthenticated response
• Confirms exploit success with cookie details
• Works with tools like Burp Suite or browser dev tools

🧠 Technical Details

• Vulnerability Type: Auth Bypass / Session Hijack
• Plugin: Pie Register for WordPress
• Affected Versions: ≤ 3.7.1.4
• Vector: Crafted POST request to login endpoint
• Impact: Attacker gains administrator-level access via hijacked cookies

⚠️ Disclaimer

This script is provided for:

• Educational purposes
• Authorized penetration testing
• Security research

You are fully responsible for any misuse. Unauthorized use of this tool may violate laws.

👤 Author

• Handle: 0xgh057r3c0n
• GitHub: github.com/0xgh057r3c0n/CVE-2025-34077

📄 License

This project is licensed under the MIT License.