# CVE-2026-96963: The Pie Register WordPress plugin authorization bypass in AJAX action

Source: https://junglewise.ai/threats/cve-2026-96963-the-pie-register-wordpress-plugin-through-3-8-4-15-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-96963 · Severity: info · Published 2026-11-08

The Pie Register WordPress plugin, which manages user registration and invitation codes, fails to properly check user permissions on one of its administrative functions. A contributor-level user can bypass these checks and modify invitation codes that were created by administrators, potentially granting unauthorized access or disrupting the registration process.

Technologies: [Pie Register](https://junglewise.ai/threats/technologies/pie-register). Vendors: [Pie Register](https://junglewise.ai/threats/vendors/pie-register).

## Quick answers

**Is CVE-2026-96963 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96963 being exploited in the wild.

**How severe is CVE-2026-96963?** Informational severity, published 8 November 2026.

**Which products and versions are affected?** Pie Register through 3.8.4.15.

**Is there a fix for CVE-2026-96963?** Yes: fixed in 3.8.4.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96963 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-96963?** Check whether you run Pie Register at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.8.4.16

## Technical details

The plugin lacks authorization validation in an AJAX action handler, allowing authenticated users with contributor role or higher to modify administrator-created invitation-code records. This is a missing access control check (CWE-862) in an AJAX endpoint. An attacker with a low-privilege account can directly invoke the vulnerable action without proper capability checks to modify sensitive records.

## Affected products

- Pie Register Pie Register through 3.8.4.15

## Timeline

- 2026-11-05: advisory
- 2026-11-08: patched

## References

- [https://wpscan.com/vulnerability/0501d724-f5cf-4b71-a463-0ab86b2ea8b5/](https://wpscan.com/vulnerability/0501d724-f5cf-4b71-a463-0ab86b2ea8b5/)

## Related threats

- [Pie Register plugin unauthenticated settings reset and data destruction](https://junglewise.ai/threats/cve-2026-96961-the-pie-register-wordpress-plugin-through-3-8-4-15-does-not)
- [Pie Register WordPress plugin predictable account verification token](https://junglewise.ai/threats/cve-2026-10530-pie-register-wordpress-plugin-predictable-account-verification)