Pie Register EUVD-2026-91949

Exploitation requires that the site runs the Pie Register plugin with its invitation-code registration feature in use, and that the attacker knows at least one valid invitation code for that site - this knowledge requirement is the primary limiting factor and the reason CVSS assigns AC:H. No authentication or user interaction is needed (PR:N/UI:N), so once a valid code is known any remote visitor can pull the report. Impact is limited to disclosure of usernames and email addresses of users registered under that specific code; no other data, write access, or service disruption results. Sites that keep invitation codes strictly private and short-lived materially reduce realistic exposure.

This is a low-severity information-disclosure issue (CVE-2026-96962, CWE-200) that is a genuine but non-urgent priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base 3.7) describes a network-reachable, unauthenticated flaw, but the High attack complexity reflects a real barrier: the attacker must already know a valid invitation code, and only low-confidentiality data (usernames and emails) is exposed with no integrity or availability impact. Multiple signals agree that this is not a high-urgency item: EPSS is 0.14% (3rd percentile, very low exploitation probability), it is NOT on the CISA KEV list, and the SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. The one signal pointing the other way is that public exploit code exists (published by WPScan), but POC availability is a distinct signal from active exploitation and the SSVC 'Exploitation: none' rating indicates no observed in-the-wild activity. The low EPSS combined with POC availability is consistent with a disclosed-but-not-widely-weaponized bug. Net: a legitimate privacy/data-leak defect worth patching in routine cycles, not an emergency; the main real-world risk is targeted enumeration of registered users rather than mass automated exploitation.

An attacker who has obtained a valid invitation code (e.g. a shared or leaked registration link) sends an unauthenticated request to the plugin's invitation-code report endpoint and retrieves the usernames and email addresses of every user who registered using that code. Public exploit code for this is available via WPScan. The High attack complexity means the attack is gated on first knowing a valid code, so it is most plausible against sites that distribute invitation codes semi-publicly or where a code has leaked.