CVE-2026-96962
Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code
Unknown Pie Register
CVSS
3.7LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.8.4.14Pie RegisterCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.
Text from CVE List
Affected versions 1
- Pie Registeraffected: all versions before 3.8.4.14CVE List