Description

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-10-03T06:16:48.670Z",
  "pubdate": "2026-10-03T06:16:48.670Z",
  "executiveSummary": "The Pie Register WordPress plugin, specifically versions prior to 3.8.4.14, contains an improper access control vulnerability that allows unauthenticated remote attackers to retrieve sensitive user information.\nThe vulnerability resides within the plugin's invitation-code reporting functionality, which fails to enforce authorization checks.\nBy supplying a valid invitation code, an unauthenticated user can trigger the endpoint to disclose the usernames and associated email addresses of all individuals who registered using that specific invitation token.\nThis represents a significant breach of data privacy, as it exposes personally identifiable information (PII) to unauthorized parties without requiring elevated privileges or active session tokens.\nThe primary risk implication is the potential for mass data harvesting, which could facilitate targeted phishing campaigns, social engineering, or further credential-based attacks against the identified users.\nExploitation is trivial, requiring only knowledge of a valid, publicly discoverable, or guessed invitation code, and does not require interaction with the administrative interface or existing user accounts.\nAdministrators are advised to update to version 3.8.4.14 or later to remediate the broken access control mechanism.",
  "technicalDetails": "The vulnerability stems from a Broken Access Control (BAC) flaw within the invitation-code processing logic of the Pie Register plugin. Specifically, the component responsible for generating and returning reports based on invitation codes lacks sufficient server-side authentication and authorization validation.\nIn the affected versions, the application endpoint designed to export or display reports for specific invitation codes does not verify the requester's identity or administrative status. When a request is submitted containing a valid invitation code parameter, the plugin executes a database query to retrieve all associated user records—specifically usernames and email addresses—and transmits this data back to the requester in a clear-text format.\nThe attack flow is straightforward: An attacker identifies the target endpoint responsible for invitation-code reporting. Because the system does not validate that the current user has the 'manage_options' capability or any other administrative privilege, the application processes the request blindly. If the attacker provides a valid invitation code—which may be obtained through social engineering, public advertisements, or brute-force enumeration if the code format is predictable—the plugin returns a comprehensive list of all users tied to that code.\nFrom a technical perspective, the root cause is the absence of a proper capability check (e.g., using current_user_can() in WordPress) prior to executing the data retrieval function. The code logic assumes that the presence of the invitation code is sufficient evidence of authorization to view the associated report, rather than validating the security context of the initiator.\nThe network exposure is global, as this endpoint is accessible via standard HTTP/HTTPS requests. No special headers, session cookies, or authenticated tokens are required to interact with the vulnerable function.\nThe post-exploitation impact is severe. An attacker can systematically enumerate invitation codes to perform mass exfiltration of user PII. This database of users can be leveraged for downstream attacks, such as targeted credential stuffing if users reuse passwords, or sophisticated phishing campaigns that appear legitimate by referencing the specific context of the invitation code used for registration."
}