CVE-2026-24577

Vulnerability

Overview The Pie Register plugin for WordPress versions up to and including 3.8.4.8 contains a missing authorization vulnerability. This is a broken access control issue where the plugin fails to properly enforce permissions, allowing unprivileged users to execute actions intended for higher-privileged roles [1].

Exploitation

Attackers can exploit this vulnerability by sending crafted requests to the affected plugin endpoints without proper authentication or nonce checks. No special network position or prior authentication is required, making it exploitable remotely by any unauthenticated user [1].

Impact

Successful exploitation could allow an attacker to perform unauthorized actions such as modifying settings or accessing sensitive data, depending on the affected functionality. The CVSS score of 5.3 (Medium) indicates a moderate risk, though the report notes it is unlikely to be widely exploited [1].

Mitigation

The vulnerability is fixed in version 3.8.4.9. Users are advised to update immediately. For Patchstack users, auto-updates can be enabled for vulnerable plugins. If unable to update, contact hosting provider for assistance [1].