Unauthorised Access to Invitation Codes in Pie Register

Executive Summary

The Pie Register WordPress plugin before version 3.8.4.16 has a vulnerability where an AJAX action does not check user permissions properly. This allows users with contributor-level access or higher to modify invitation-code records created by administrators.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the Pie Register plugin. If it is below 3.8.4.16, the system is vulnerable. Use WordPress admin dashboard or run a command like 'wp plugin list' if using WP-CLI to verify the version.

Useful 0 Not Useful 0

Impact Analysis

An attacker with contributor access could alter administrator-created invitation codes, potentially allowing unauthorized access or misuse of the plugin's features. This could lead to data integrity issues or unauthorized user privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to user access controls, potentially violating data protection requirements under GDPR or HIPAA that mandate strict access controls and integrity of user permissions.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Pie Register plugin to version 3.8.4.16 or later immediately. If updating is not possible, consider disabling the plugin until the update can be applied to prevent exploitation.

Useful 0 Not Useful 0