CVE-2026-96962

LowCVSS 3.7

Published: 03/10/2026(UTC)Updated: 03/10/2026(UTC)Translated: 03/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report. An unauthenticated visitor who knows a valid invitation code can obtain the usernames and email addresses of every user who registered with that code.

Risk Assessment

Leakage of personal data (usernames, email addresses) can be used for phishing, spam, or account attacks. It also violates GDPR data protection requirements.

Recommendation

Update the Pie Register plugin to version 3.8.4.14 or later. Until then, consider disabling the invitation-code reporting feature or restricting access to it.

Other vulnerabilities in Pie Register WordPress plugin

CVE-2026-10530Medium
The Pie Register WordPress plugin before version 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.

Original NVD description (English source)

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS