Executive brief
Pie Register is a WordPress plugin used to manage user registration and profile forms. A security flaw in versions prior to 3.8.4.10 allows attackers to bypass email verification requirements. By predicting the security codes used for account activation, an unauthorized user can activate an account without having access to the registered email address, potentially bypassing security controls intended to verify user identity.
Technical details
The Pie Register plugin for WordPress fails to use a cryptographically secure pseudo-random number generator (CSPRNG) for account verification tokens in versions prior to 3.8.4.10. Specifically, the activation token was generated using an MD5 hash of the current Unix timestamp (time()). Because the server's time can be determined from HTTP response headers, an unauthenticated attacker can predict the valid token within a small window of candidates. By submitting these predicted hashes to the activation endpoint, an attacker can successfully activate a newly registered account without access to the associated email inbox. The issue is resolved in version 3.8.4.10 by switching to the wp_generate_password() function for token generation.
Affected products
- Pie Register Pie Register < 3.8.4.10
Timeline
- 2026-06-01: disclosed: Vulnerability details published by WPScan
- 2026-06-01: patched: Fixed in version 3.8.4.10
- 2026-06-22: advisory: CVE-2026-10530 published to NVD