EUVD-2026-38210
GHSA-7m4f-cfr6-pwp7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-exploitable with no auth or user interaction; integrity impact limited to account activation bypass; no confidentiality or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.
AnalysisAI
Pie Register WordPress plugin versions before 3.8.4.10 generates account verification tokens with insufficient randomness, enabling unauthenticated remote attackers to predict or enumerate valid tokens and activate registered accounts without receiving the associated verification email. This effectively bypasses the email-as-ownership-proof step in the registration flow, allowing account takeover of any pending registration. A publicly available exploit exists per WPScan; SSVC flags the attack as automatable with partial technical impact, though no confirmed active exploitation appears in CISA KEV at time of analysis.
Technical ContextAI
The Pie Register plugin implements a self-registration flow for WordPress sites, generating a one-time verification token sent to the registrant's email address. The root cause - while not formally assigned a CWE - aligns with CWE-330 (Use of Insufficiently Random Values): the token space is either too small, seeded deterministically (e.g., timestamp or sequential counter), or generated via a weak PRNG, making values predictable to an external observer. Affected product is identified via CPE cpe:2.3:a:unknown:pie_register:*:*:*:*:*:*:*:* covering all versions below 3.8.4.10. The WordPress plugin ecosystem runs PHP, where misuse of rand() or mt_rand() (non-cryptographic PRNGs) instead of random_bytes() or wp_generate_password() is a known class of registration-token weakness.
RemediationAI
Update Pie Register to version 3.8.4.10 or later - this is the vendor-released patch confirmed by WPScan (https://wpscan.com/vulnerability/bd3fe1d2-9f21-4b51-9112-2971a25a7e62/). If immediate patching is not possible, a compensating control is to disable open user registration on the WordPress site entirely (Settings > General > uncheck 'Anyone can register'), which removes the exploitable surface at the cost of blocking legitimate self-registration. Alternatively, site administrators can implement an additional registration step requiring manual admin approval for each new account, which prevents automated token prediction from resulting in active accounts even if tokens are guessed. Do not rely solely on network-layer controls, as the attack vector is a standard HTTP request to the activation endpoint.
More in Pie Register
View allThe Registration Forms - User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPres
SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute ar
The Registration Forms - User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPres
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-regist
Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for Wor
The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an i
Unrestricted Upload of File with Dangerous Type vulnerability in Pie Register.8.3.1. Rated critical severity (CVSS 10.0)
The Pie Register - User Registration Forms. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable
The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969. Rated criti
Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for W
The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in an
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today