CVE-2025-49029

WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability

9.1 CriticalPublic exploit

Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through <= 1.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.36%Up 2.3 points since Jul 2, 2025

What each source reports

CVE List Score used 9.1

WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability

Record: CVE-2025-49029
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2025-19622 9.1

Record: EUVD-2025-19622
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4mv9-2h4p-3hrx 9.1

Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.Kazi Custom...

Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.Kazi Custom Login And Signup Widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through 1.0.

Record: GHSA-4mv9-2h4p-3hrx
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

NVD 9.1

Record: CVE-2025-49029
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	WordPress Custom Login And Signup Widget Plugin <= 1.0 - Arbitrary Code Execution
PoC in GitHub	Nxploited/CVE-2025-49029	2025-07-01

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-49029 is a critical vulnerability (CVSS 9.1) in Bitto.kazi Custom Login And Signup Widget, published July 1, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.36%, the 83rd percentile. No source names a fixed version.