Pie Register CVE-2026-103345

No special conditions beyond having the Pie Register plugin installed and active on a WordPress site at version 3.8.4.13 or earlier - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation requiring no user interaction against default configurations. The practical limiting factors are that the plugin must be present and the impact is confined to disclosure of limited sensitive information (C:L, no integrity/availability effect); the specific endpoint or data element exposed is not detailed in the available advisory.

This is a genuine but low-urgency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 Medium) describes a remotely reachable, low-complexity, unauthenticated information-disclosure flaw with only limited confidentiality impact and no integrity or availability impact, consistent with CWE-201 (Insertion of Sensitive Information Into Sent Data). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The signals are internally consistent - there is no CVSS-versus-description conflict - but the single-source nature (Patchstack database only) and the absence of a confirmed fixed version limit certainty. Overall this is a real, easily reachable but low-impact leak: worth patching on a normal cycle rather than an emergency, since it exposes only limited sensitive data and offers no direct code execution or account takeover.

An unauthenticated remote attacker sends ordinary requests to a WordPress site running a vulnerable Pie Register version and receives responses that embed sensitive information the plugin should not disclose (e.g., data returned in registration/login form flows or API responses). Given AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is needed. No public proof-of-concept exploit was identified in the provided data.