CVE-2026-96962

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-03

Last updated on: 2026-10-06

Assigner: WPScan

Description

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-03

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96962

EUVD

EUVD-2026-91949

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Pie	Register 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The Pie Register WordPress plugin before version 3.8.4.14 has a vulnerability where unauthenticated users with a valid invitation code can access an invitation-code report. This report exposes the usernames and email addresses of all users who registered using that code.

Detection Guidance

To detect this vulnerability, check if the Pie Register plugin version is below 3.8.4.14. Use WordPress admin panel or run commands like 'wp plugin list' in WP-CLI to verify the installed version. Test if an unauthenticated request to '/wp-admin/admin-ajax.php?action=pie_invitation_code_report&invitation_code=VALID_CODE' returns user data.

Impact Analysis

This vulnerability allows attackers to collect sensitive user data (usernames and emails) without authentication. If you use this plugin, your users' personal information could be exposed, leading to privacy risks or potential misuse of their data.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing personal user data without proper authorization. Organizations may face legal penalties or reputational damage if user data is compromised due to this flaw.

Mitigation Strategies

Immediately update the Pie Register plugin to version 3.8.4.14 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review user invitation codes and restrict access to sensitive data reports.

Hi! I’m here to help you understand CVE-2026-96962. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70