---
id: CVE-2026-96962
title: >-
  The Pie Register  WordPress plugin before 3.8.4.14 does not restrict access to
  an invitation-code report, allowing unauthenticated visitors who know a valid
  invitation code to obtain the username and email address of every user who
  regis…
summary: >-
  The Pie Register  WordPress plugin before 3.8.4.14 does not restrict access to
  an invitation-code report, allowing unauthenticated visitors who know a valid
  invitation code to obtain the username and email address of every user who
  regis…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
product: Pie Register
affected:
  - pie_register < 3.8.4.14
published: '2026-10-03'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T15:18:12.170'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-96962'
references:
  - url: 'https://wpscan.com/vulnerability/bf634ddf-277e-46a4-9e5b-7253b3e02979/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00166
epssPercentile: 0.05901
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-03T14:59:52.889050Z'
ingestedAt: '2026-10-03T06:39:57.570Z'
---

## Overview

The Pie Register  WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.