CVE-2026-96961: medium-severity vulnerability in Pie Register
Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data Destruction
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.5epss 0.2%
The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated attackers to reset the Pie Register WordPress plugin through 3.8.4.15's settings to their defaults (disabling registration security controls such as new-user email verification) and to destroy a Pie Register WordPress plugin through 3.8.4.15 data table.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
Unknown · Pie Registerpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/d7de0e99-2637-40a3-9cdd-b633363334e0/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Pie Register
In the same product, most dangerous first.
CVE-2026-10530MEDIUMPie Register < 3.8.4.10 - Unauthenticated Email Verification Bypass via Predictable TokenEPSS 0.2%CVE-2026-96963LOWPie Register <= 3.8.4.15 - Contributor+ Invitation Code ModificationEPSS 0.2%CVE-2026-96962LOWPie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation CodeEPSS 0.2%