What is the CVSS score of CVE-2026-3571?

CVE-2026-3571 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3571

EUVD-2026-18965 MEDIUM

Missing Authorization (CWE-862)

2026-04-04 Wordfence

GHSA-f2v8-p56h-3qj9

WordPress Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 04, 2026 - 02:15 euvd

EUVD-2026-18965

Analysis Generated

Apr 04, 2026 - 02:15 vuln.today

CVE Published

Apr 04, 2026 - 01:24 nvd

MEDIUM 6.5

DescriptionCVE.org

The Pie Register - User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pie_main() function in all versions up to, and including, 3.8.4.8. This makes it possible for unauthenticated attackers to change registration form status.

AnalysisAI

Unauthenticated attackers can modify registration form status in Pie Register plugin for WordPress versions up to 3.8.4.8 due to a missing capability check in the pie_main() function. The vulnerability allows unauthorized changes to critical registration settings without authentication, impacting the integrity of user registration workflows. CVSS 6.5 reflects moderate severity with both confidentiality and availability impact; no public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

Pie Register is a WordPress plugin that manages user registration forms, profiles, and content access restrictions. The vulnerability stems from CWE-862 (Missing Authorization), where the pie_main() function fails to verify user capabilities before processing registration form modifications. WordPress capabilities are the authorization framework that controls which users can perform specific actions; the absence of a capability check (such as current_user_can()) creates an authorization bypass. The affected CPE (genetechproducts:pie_register_-_user_registration,_profiles_&_content_restriction) indicates all versions through 3.8.4.8 are impacted. The CVSS vector (PR:N) confirms the attack requires no prior privilege or authentication, and the network-based attack vector (AV:N) with low complexity (AC:L) means the attack is trivial to execute remotely via HTTP requests.

RemediationAI

Update Pie Register to version 3.8.4.9 or later, which includes the capability check fix. Administrators should immediately upgrade via the WordPress plugin dashboard (Plugins > Installed Plugins > Pie Register > Update) or download the patched version from plugins.trac.wordpress.org/changeset/3494602/pie-register. As an interim workaround pending upgrade, restrict plugin access via WordPress role and capability management to trusted administrators only, though this does not fully mitigate the unauthenticated attack surface. Verify registration form settings after upgrade to ensure no unauthorized modifications were made during the vulnerability window.