Vulnerabilities / Pie Register / WPSEC-2026-0089
Pie Register <= 3.8.4.13 - Missing Authorization to Unauthenticated User Email Disclosure via 'invitaion_code' Parameter
Medium 5.3
CWE-862Fixed in 3.8.4.14
- ID
- WPSEC-2026-0089
- Plugin
- Pie Register – User Registration, Profiles & Content Restriction (pie-register)
- Affected
- from 2.0.8 before 3.8.4.14
- Remediation
- Update to 3.8.4.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Pie Register on WPSec AttackSurface
- Fix released
- Published
Description
The Pie Register plugin for WordPress is vulnerable to unauthorized access of user data due to a missing authorization check on the show_invitaion_code_user() function, which runs on the 'init' hook whenever the 'show_dash_widget' and 'invitaion_code' GET parameters are present, in versions 2.0.8 up to, and including, 3.8.4.13. This makes it possible for unauthenticated attackers who know (or guess) an invitation code to list the usernames and email addresses of every user who registered with that code.
References
- https://wpsec.com/vuln/WPSEC-2026-0089/
- https://plugins.svn.wordpress.org/pie-register/tags/3.8.4.14/
- https://wordpress.org/plugins/pie-register/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS