CVE-2026-96963: Pie Register <= 3.8.4.15 - Contributor+ Invitation Code Modification

Q: Who can exploit this issue?

Any authenticated WordPress user with the Contributor role or a higher-privileged role can exploit the affected AJAX action. The issue does not require administrator access.

Q: What can an attacker change?

A Contributor-level user can modify existing invitation-code records that were created by an administrator.

Q: Which versions are affected?

Pie Register versions through 3.8.4.15 are affected.

Published Nov 8, 2026

Updated

The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with the Contributor role or a higher-privileged role can exploit the affected AJAX action. The issue does not require administrator access.

What can an attacker change?

A Contributor-level user can modify existing invitation-code records that were created by an administrator.

Which versions are affected?

Pie Register versions through 3.8.4.15 are affected.

CVE-2026-96963: Pie Register <= 3.8.4.15 - Contributor+ Invitation Code Modification

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change?

Which versions are affected?