CVE-2025-49029CWE-94

WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability

Critical · published July 1, 2025

CVSS v3.1
9.1
EPSS
2%
Percentile
83.6
In the wild
Unconfirmed
What it is

🔥 A crafty code injection vulnerability lurks in the Custom Login And Signup Widget, allowing attackers to execute their own code—no magic wand required! Think of it as a restaurant where a diner can sneak in their own secret recipe and swap it out for the chef's special—nobody checks the ingredients before serving! An attacker could insert harmful code, potentially gaining full control over your application. This could lead to data theft, unauthorized access, or even complete takeover of your system. The effects could be absolutely devastating!

Put simply

Think of it as a restaurant where a diner can sneak in their own secret recipe and swap it out for the chef's special—nobody checks the ingredients before serving! This vulnerability allows for code injection, which means that an attacker can input malicious code that the system will execute, compromising the security of the application. It affects versions of the Custom Login And Signup Widget from n/a through 1.0.

What to do

An attacker could insert harmful code, potentially gaining full control over your application. This could lead to data theft, unauthorized access, or even complete takeover of your system. The effects could be absolutely devastating! Patch to the latest version of the Custom Login And Signup Widget as soon as possible to fix this critical vulnerability. Additionally, review and sanitize all user inputs to prevent any code injections from occurring in the future. You've got this! Follow these steps and you’ll be well on your way to securing your application! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02359 · 83.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-07-01T13:27Z
EPSS history
Timeline
  • 01 JUL 13:27Z
    WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability
    cvelistv5