CVE-2026-96963 · Package
NO FIX YET
The Pie Register WordPress plugin through 3.8.4.15 has an AJAX action that skips its authorisation check. A logged-in user with the contributor role or higher can change invitation-code records that administrators created.
first public Nov 8, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Pie Register plugin through 3.8.4.15 that use invitation codes for registration. The attacker needs a contributor-level account or higher. Sites without this plugin, or without invitation codes, are not affected by this description.
Not affected if auth-required, plugin-not-installed
Who cares pie-register, wordpress
3.8.4.15 are listed as affected.No fix yet, per the sources.
The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.