CVE-2026-96962
Received Received - Intake

Unauthenticated User Enumeration in Pie Register WordPress Plugin

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: WPScan

Description
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-96962
EUVD
EUVD-2026-91949

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pie_register pie_register to 3.8.4.14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Pie Register WordPress plugin before version 3.8.4.14 has a vulnerability where unauthenticated users with a valid invitation code can access an invitation-code report. This report exposes the usernames and email addresses of all users who registered using that code.

Detection Guidance

To detect this vulnerability, check if the Pie Register plugin version is below 3.8.4.14. Use WordPress admin panel or run commands like 'wp plugin list' in WP-CLI to verify the installed version. Test if an unauthenticated request to '/wp-admin/admin-ajax.php?action=pie_invitation_code_report&invitation_code=VALID_CODE' returns user data.

Impact Analysis

This vulnerability allows attackers to collect sensitive user data (usernames and emails) without authentication. If you use this plugin, your users' personal information could be exposed, leading to privacy risks or potential misuse of their data.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing personal user data without proper authorization. Organizations may face legal penalties or reputational damage if user data is compromised due to this flaw.

Mitigation Strategies

Immediately update the Pie Register plugin to version 3.8.4.14 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review user invitation codes and restrict access to sensitive data reports.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96962. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart