{"id":"CVE-2026-10530","aliases":["EUVD-2026-38210","GHSA-7m4f-cfr6-pwp7"],"status":"published","title":"Pie Register \u003c 3.8.4.10 - Unauthenticated Email Verification Bypass via Predictable Token","description":"The Pie Register  WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00204,"percentile":0.10488,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-06-22T06:00:01Z","modified":"2026-06-22T18:38:02Z","products":[{"vendor":"genetech products","product":"pie register"},{"vendor":"unknown","product":"pie register"}],"references":[{"url":"https://wpscan.com/vulnerability/bd3fe1d2-9f21-4b51-9112-2971a25a7e62/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10530"},{"url":"https://wpscan.com/vulnerability/bd3fe1d2-9f21-4b51-9112-2971a25a7e62"},{"url":"https://github.com/advisories/GHSA-7m4f-cfr6-pwp7"}],"sources":{"cve":[{"id":"CVE-2026-10530","title":"Pie Register \u003c 3.8.4.10 - Unauthenticated Email Verification Bypass via Predictable Token","description":"The Pie Register  WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.","status":"published","published":"2026-06-22T06:00:01.515Z","modified":"2026-06-22T16:35:29.679Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T13:40:12.486331Z"}],"euvd":[{"id":"EUVD-2026-38210","description":"The Pie Register  WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.","status":"published","published":"2026-06-22T06:00:01Z","modified":"2026-06-22T16:35:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:34.238696Z"}],"ghsa":[{"id":"GHSA-7m4f-cfr6-pwp7","title":"The Pie Register  WordPress plugin before 3.8.4.10 does not use sufficiently random values when...","description":"The Pie Register  WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.","status":"published","published":"2026-06-22T09:30:45Z","modified":"2026-06-22T18:35:14Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:08:56.309175Z"}],"nvd":[{"id":"CVE-2026-10530","description":"The Pie Register  WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.","status":"published","published":"2026-06-22T06:16:15.623Z","modified":"2026-06-22T18:38:02.507Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:24.912854Z"}]}}