Pie Register User Registration Profiles Content Restriction EUVD-2026-18965

Pie Register is a WordPress plugin that manages user registration forms, profiles, and content access restrictions. The vulnerability stems from CWE-862 (Missing Authorization), where the pie_main() function fails to verify user capabilities before processing registration form modifications. WordPress capabilities are the authorization framework that controls which users can perform specific actions; the absence of a capability check (such as current_user_can()) creates an authorization bypass. The affected CPE (genetechproducts:pie_register_-_user_registration,_profiles_&_content_restriction) indicates all versions through 3.8.4.8 are impacted. The CVSS vector (PR:N) confirms the attack requires no prior privilege or authentication, and the network-based attack vector (AV:N) with low complexity (AC:L) means the attack is trivial to execute remotely via HTTP requests.