{
 "id": "WPSEC-2026-2123",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2123/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2123/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2123/index.md",
 "title": "Pie Register <= 3.8.4.15 - Unauthenticated Authentication Bypass via Account Activation and Verification Links",
 "description": "The pie-register plugin for WordPress is vulnerable to authentication bypass via the account activation, admin verification and PayPal IPN flows in all versions up to, and including, 3.8.4.15. This is due to insufficient validation of activation tokens. The e-mail activation link activates accounts that are still awaiting payment, and the 'hash' token those accounts need is shown to the registrant in the PayPal payment link. An activation or verification key that is empty after sanitizing matches every user holding the meta key. The PayPal IPN handler compares the stored hash with the supplied one using a loose comparison that accepts empty values. This makes it possible for unauthenticated attackers to activate an account they registered without paying, and in some configurations to activate or verify accounts without the secret token or administrator approval.",
 "plugin": {
  "slug": "pie-register",
  "name": "Pie Register",
  "full_name": "Pie Register – User Registration, Profiles & Content Restriction",
  "wordpress_org": "https://wordpress.org/plugins/pie-register/",
  "advisories_url": "https://wpsec.com/vuln/plugin/pie-register/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/pie-register"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8.4.16",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8.4.16"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8.4.16",
 "remediation": "Update to 3.8.4.16 or later.",
 "fix_released": "2026-10-29T15:50:48+00:00",
 "published": "2026-10-30T15:52:38+00:00",
 "updated": "2026-10-30T09:24:51.834726+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2123/",
  "https://plugins.svn.wordpress.org/pie-register/tags/3.8.4.16/",
  "https://wordpress.org/plugins/pie-register/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/pie-register",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}