# Pie Register <= 3.8.4.15 - Unauthenticated Authentication Bypass via Account Activation and Verification Links

- **ID:** WPSEC-2026-2123
- **Plugin:** Pie Register – User Registration, Profiles & Content Restriction (`pie-register`), https://wordpress.org/plugins/pie-register/
- **Affected versions:** all versions before 3.8.4.16
- **Fixed in:** 3.8.4.16 (Update to 3.8.4.16 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/pie-register
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2123/

## Description

The pie-register plugin for WordPress is vulnerable to authentication bypass via the account activation, admin verification and PayPal IPN flows in all versions up to, and including, 3.8.4.15. This is due to insufficient validation of activation tokens. The e-mail activation link activates accounts that are still awaiting payment, and the 'hash' token those accounts need is shown to the registrant in the PayPal payment link. An activation or verification key that is empty after sanitizing matches every user holding the meta key. The PayPal IPN handler compares the stored hash with the supplied one using a loose comparison that accepts empty values. This makes it possible for unauthenticated attackers to activate an account they registered without paying, and in some configurations to activate or verify accounts without the secret token or administrator approval.

## References

- https://wpsec.com/vuln/WPSEC-2026-2123/
- https://plugins.svn.wordpress.org/pie-register/tags/3.8.4.16/
- https://wordpress.org/plugins/pie-register/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2123/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.