---
id: "CVE-2026-96961"
page: "https://infrastack.ai/live/CVE-2026-96961"
kind: "vulnerability"
aliases: ["CVE-2026-96961"]
title: "Pie Register WordPress plugin: unauthenticated settings reset and data table wipe"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "pie-register", "fixed": ["3.8.4.16"], "affected": "<= 3.8.4.15", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "pie-register", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-08T06:17:05+00:00"
first_seen_at: "2026-11-08T06:46:21+00:00"
updated_at: "2026-11-08T06:48:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96961", "first_seen_at": "2026-11-08T06:46:21+00:00"}, {"source": "analyst", "url": "https://wpsec.com/vuln/WPSEC-2026-2121/", "first_seen_at": "2026-11-08T06:48:59+00:00", "cites": ["https://wpsec.com/vuln/WPSEC-2026-2121/"]}]
exploit_sources: []
---

# Pie Register WordPress plugin: unauthenticated settings reset and data table wipe

Link for people: https://infrastack.ai/live/CVE-2026-96961 (this .md is for agents)

The Pie Register WordPress plugin up to version 3.8.4.15 has a request handler with no authentication or permission check. An unauthenticated attacker can reset its settings to defaults, which turns off registration protections such as email verification, and can destroy one of its database tables.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:pie-register affected <= 3.8.4.15 fixed 3.8.4.16

## How to check

- Run wp plugin get pie-register --field=version; versions up to and including 3.8.4.15 are affected
- Look for unauthenticated POST requests containing the piereg_default_settings parameter in web server logs
- Check Pie Register settings (Security tab, email verification) for unexpected reset to defaults

## Fix

Update Pie Register to 3.8.4.16 or later (per WPSec; vendor changelog not read)

## Timeline

- 2026-11-08T06:46:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96961
- 2026-11-08T06:48:59+00:00 analyst https://wpsec.com/vuln/WPSEC-2026-2121/ — WPSec (third party, not vendor) says fixed in 3.8.4.16 (released 2026-10-29), settings reset via unauthenticated 'piereg_default_settings' POST param, and links it to this CVE. Table wipe not mentioned by WPSec. Vendor changelog/NVD page could not be fetched, so nothing marked verified.

## Documents

- [describes] WPSEC-2026-2121 Pie Register <= 3.8.4.15 settings reset https://wpsec.com/vuln/WPSEC-2026-2121/

## From the sources

The Pie Register  WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated attackers to reset the Pie Register  WordPress plugin through 3.8.4.15's settings to their defaults (disabling registration security controls such as new-user email verification) and to destroy a Pie Register  WordPress plugin through 3.8.4.15 data table.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_