A vulnerability in the WordPress Pie Register plugin allows an unauthenticated attacker to spoof any user by sending a crafted POST to the login endpoint. The attacker can set a parameter that causes a valid session cookie to be generated for any user ID, including administrators. With that session, the attacker can use the plugin’s upload feature to install a malicious PHP plugin and run arbitrary code on the server. The flaw stems from missing authentication checks, unrestricted file upload, and lack of proper input validation, as reflected in CWE‑306, CWE‑434 and CWE‑94.

Genetech Solutions’ WordPress Pie Register Plugin version 3.7.1.4 or earlier is affected. The vulnerability exists in all installations using this or earlier plugin releases on WordPress sites.

The CVSS score of 10 indicates critical severity, and an EPSS score of 76% shows a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it purely remotely by sending an unauthenticated POST request to the login endpoint, forging authentication, and then uploading a malicious plugin via the provided upload function. Exploitation tools such as the Rapid7 Metasploit module and publicly available scripts confirm the attack path is straightforward for attackers with internet access to the vulnerable site.