low2.7
CVE-2026-96963
The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as con…
Impact
The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.
An attacker can exploit this over the network, with an administrator account, without any action by a user. If it succeeds: low risk of data or systems being changed.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Genetech Products | Pie Register | Version 0 ≤3.8.4.15 |
| Unknown | Pie Register | through 3.8.4.15 |