{"id":"CVE-2026-96961","kind":"vulnerability","aliases":["CVE-2026-96961"],"related":[],"title":"Pie Register WordPress plugin: unauthenticated settings reset and data table wipe","description":"The Pie Register  WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated attackers to reset the Pie Register  WordPress plugin through 3.8.4.15's settings to their defaults (disabling registration security controls such as new-user email verification) and to destroy a Pie Register  WordPress plugin through 3.8.4.15 data table.","summary":"The Pie Register WordPress plugin up to version 3.8.4.15 has a request handler with no authentication or permission check. An unauthenticated attacker can reset its settings to defaults, which turns off registration protections such as email verification, and can destroy one of its database tables.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pie-register","fixed":["3.8.4.16"],"affected":"<= 3.8.4.15","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","pie-register","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Run wp plugin get pie-register --field=version; versions up to and including 3.8.4.15 are affected\n- Look for unauthenticated POST requests containing the piereg_default_settings parameter in web server logs\n- Check Pie Register settings (Security tab, email verification) for unexpected reset to defaults","fix":"Update Pie Register to 3.8.4.16 or later (per WPSec; vendor changelog not read)","status":"open","published_at":"2026-11-08T06:17:05+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:11+00:00","updated_at":"2026-11-08T06:48:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T06:47:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Pie Register WordPress plugin: unauthenticated settings reset and data table wipe","impact":"medium","summary":"The Pie Register WordPress plugin up to version 3.8.4.15 has a request handler with no authentication or permission check. An unauthenticated attacker can reset its settings to defaults, which turns off registration protections such as email verification, and can destroy one of its database tables.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","pie-register","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Settings reset and a data table destroyed by anyone on the internet","analyst_note":"Find the fixed version and vendor advisory for Pie Register after 3.8.4.15 at the NVD entry, and confirm the vulnerable handler's default exposure.","how_to_check":"- Check the installed Pie Register version in the WordPress admin under Plugins, or with `wp plugin get pie-register --field=version`\n- Compare the result against the fixed version, which the sources do not state","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running Pie Register up to and including 3.8.4.15 is exposed, because the vulnerable handler accepts requests without logging in. Sites without this plugin, or running a later version, are not affected. The sources do not say whether a non-default setting is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4594,"output_tokens":556,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed version and vendor advisory for Pie Register after 3.8.4.15 at the NVD entry, and confirm the vulnerable handler's default exposure.","search":"'-2026':13A,16A '-96961':14A,17A '3.8.4.15':37B,80C,107C,133C 'allow':96C 'attack':50B,98C 'authent':44B,88C 'capabl':85C 'check':47B,89C 'control':116C 'cve':12A,15A 'data':9A,134C 'databas':72B 'default':56B,112C 'destroy':68B,126C 'disabl':113C 'email':64B,122C 'handler':41B,95C 'host':27B 'new':120C 'new-us':119C 'nonc':86C 'one':69B,91C 'packag':21B 'perform':83C 'permiss':46B 'pie':1A,19A,23B,30B,75C,102C,128C 'pie-regist':22B 'pie-register':18A 'plugin':4A,33B,78C,105C,131C 'protect':61B 'regist':2A,24B,31B,76C,103C,129C 'register':20A 'registr':60B,114C 'request':40B,94C 'reset':7A,52B,100C 'secur':115C 'self':26B 'self-host':25B 'set':6A,54B,109C 'tabl':10A,73B,135C 'turn':58B 'unauthent':5A,49B,97C 'user':121C 'verif':65B,123C 'version':36B 'wipe':11A 'wordpress':3A,28B,32B,77C,104C,130C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running Pie Register up to and including 3.8.4.15 is exposed, because the vulnerable handler accepts requests without logging in. Sites without this plugin, or running a later version, are not affected. The sources do not say whether a non-default setting is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["pieregister"],"ptokens":["pie","register"],"labels":["high","package","pieregister","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96961':14A,17A 'cve':12A,15A 'data':9A 'pie':1A,19A 'pie-register':18A 'plugin':4A 'regist':2A 'register':20A 'reset':7A 'set':6A 'tabl':10A 'unauthent':5A 'wipe':11A 'wordpress':3A","search_b":"'3.8.4.15':37B 'attack':50B 'authent':44B 'check':47B 'databas':72B 'default':56B 'destroy':68B 'email':64B 'handler':41B 'host':27B 'one':69B 'packag':21B 'permiss':46B 'pie':23B,30B 'pie-regist':22B 'plugin':33B 'protect':61B 'regist':24B,31B 'registr':60B 'request':40B 'reset':52B 'self':26B 'self-host':25B 'set':54B 'tabl':73B 'turn':58B 'unauthent':49B 'verif':65B 'version':36B 'wordpress':28B,32B","search_c":"'3.8.4.15':80C,107C,133C 'allow':96C 'attack':98C 'authent':88C 'capabl':85C 'check':89C 'control':116C 'data':134C 'default':112C 'destroy':126C 'disabl':113C 'email':122C 'handler':95C 'new':120C 'new-us':119C 'nonc':86C 'one':91C 'perform':83C 'pie':75C,102C,128C 'plugin':78C,105C,131C 'regist':76C,103C,129C 'registr':114C 'request':94C 'reset':100C 'secur':115C 'set':109C 'tabl':135C 'unauthent':97C 'user':121C 'verif':123C 'wordpress':77C,104C,130C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96961","severity":null,"published_at":"2026-11-08T06:17:05+00:00","modified_at":"2026-11-08T06:17:05+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96961:2168","url":"https://wpsec.com/vuln/WPSEC-2026-2121/","severity":null,"published_at":"2026-11-08T06:48:59+00:00","modified_at":"2026-11-08T06:48:59+00:00","first_seen_at":"2026-11-08T06:48:59+00:00","fetched_at":"2026-11-08T06:48:59+00:00","note":"WPSec (third party, not vendor) says fixed in 3.8.4.16 (released 2026-10-29), settings reset via unauthenticated 'piereg_default_settings' POST param, and links it to this CVE. Table wipe not mentioned by WPSec. Vendor changelog/NVD page could not be fetched, so nothing marked verified.","cites":["https://wpsec.com/vuln/WPSEC-2026-2121/"]}],"documents":[{"id":100289,"url":"https://wpsec.com/vuln/WPSEC-2026-2121/","title":"WPSEC-2026-2121 Pie Register <= 3.8.4.15 settings reset","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}