Pie Register <= 3.8.4.15 - Unauthenticated Authentication Bypass via Account Activation and Verification Links
- ID
- WPSEC-2026-2123
- Plugin
- Pie Register – User Registration, Profiles & Content Restriction (pie-register)
- Affected
- all versions before 3.8.4.16
- Remediation
- Update to 3.8.4.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Pie Register on WPSec AttackSurface
- Fix released
- Published
Description
The pie-register plugin for WordPress is vulnerable to authentication bypass via the account activation, admin verification and PayPal IPN flows in all versions up to, and including, 3.8.4.15. This is due to insufficient validation of activation tokens. The e-mail activation link activates accounts that are still awaiting payment, and the 'hash' token those accounts need is shown to the registrant in the PayPal payment link. An activation or verification key that is empty after sanitizing matches every user holding the meta key. The PayPal IPN handler compares the stored hash with the supplied one using a loose comparison that accepts empty values. This makes it possible for unauthenticated attackers to activate an account they registered without paying, and in some configurations to activate or verify accounts without the secret token or administrator approval.
References
- https://wpsec.com/vuln/WPSEC-2026-2123/
- https://plugins.svn.wordpress.org/pie-register/tags/3.8.4.16/
- https://wordpress.org/plugins/pie-register/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS