{"id":"CVE-2026-96963","aliases":["EUVD-2026-119467","GHSA-2mgp-38q6-99x9"],"status":"published","title":"Pie Register \u003c= 3.8.4.15 - Contributor+ Invitation Code Modification","description":"The Pie Register  WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00168,"percentile":0.06242,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-11-08T06:00:29Z","modified":"2026-11-08T19:05:28Z","products":[{"vendor":"genetech products","product":"pie register"},{"vendor":"unknown","product":"pie register"}],"references":[{"url":"https://wpscan.com/vulnerability/0501d724-f5cf-4b71-a463-0ab86b2ea8b5/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96963"},{"url":"https://wpscan.com/vulnerability/0501d724-f5cf-4b71-a463-0ab86b2ea8b5"},{"url":"https://github.com/advisories/GHSA-2mgp-38q6-99x9"}],"sources":{"cve":[{"id":"CVE-2026-96963","title":"Pie Register \u003c= 3.8.4.15 - Contributor+ Invitation Code Modification","description":"The Pie Register  WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.","status":"published","published":"2026-11-08T06:00:29.071Z","modified":"2026-11-08T19:05:28.095Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-08T20:44:32.128624Z"}],"euvd":[{"id":"EUVD-2026-119467","description":"The Pie Register  WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.","status":"published","published":"2026-11-08T06:00:29Z","modified":"2026-11-08T19:05:28Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-08T20:13:56.600577Z"}],"ghsa":[{"id":"GHSA-2mgp-38q6-99x9","title":"The Pie Register  WordPress plugin through 3.8.4.15 does not perform an authorisation check in...","description":"The Pie Register  WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.","status":"published","published":"2026-11-08T06:30:23Z","modified":"2026-11-08T21:30:33Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-862"],"updated_at":"2026-11-08T21:44:55.230767Z"}],"nvd":[{"id":"CVE-2026-96963","description":"The Pie Register  WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.","status":"published","published":"2026-11-08T06:17:05.89Z","modified":"2026-11-10T16:28:46.51Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-08T22:11:13.623406Z"}]}}