Vulnerabilities and security researches forpie-register pie-register
Direction: ascendingJun 07, 2024
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2015-7682
- CVE, Research URL
- Date
- Oct 17, 2015
- Research Description
- Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin.php.
- Affected versions
-
max 2.0.19.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2015-7377
- CVE, Research URL
- Date
- Oct 17, 2015
- Research Description
- Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.
- Affected versions
-
max 2.0.19.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2019-15659
- CVE, Research URL
- Date
- Aug 27, 2019
- Research Description
- The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
- Affected versions
-
max 3.1.2.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2021-24647
- CVE, Research URL
- Date
- Nov 08, 2021
- Research Description
- The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
- Affected versions
-
max 3.7.1.6.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2021-24731
- CVE, Research URL
- Date
- Nov 08, 2021
- Research Description
- The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
- Affected versions
-
max 3.7.1.6.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2021-24239
- CVE, Research URL
- Date
- Apr 23, 2021
- Research Description
- The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
- Affected versions
-
max 3.7.0.1.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2013-4954
- CVE, Research URL
- Date
- Jul 30, 2013
- Research Description
- Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a register action. NOTE: some of these details are obtained from third party information.
- Affected versions
-
max 1.31.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2018-10969
- CVE, Research URL
- Date
- Jun 17, 2018
- Research Description
- SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.
- Affected versions
-
max 3.0.10.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2014-8802
- CVE, Research URL
- Date
- Jan 23, 2015
- Research Description
- The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.
- Affected versions
-
max 2.0.14.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2022-4024
- CVE, Research URL
- Date
- Dec 19, 2022
- Research Description
- The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)
- Affected versions
-
Min 2.0.14, max 3.8.1.3.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2023-0552
- CVE, Research URL
- Date
- Feb 27, 2023
- Research Description
- The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability
- Affected versions
-
max 3.8.2.3.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2024-4544
- CVE, Research URL
- Date
- May 24, 2024
- Research Description
- The Pie Register - Social Sites Login (Add on) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.7. This is due to insufficient verification on the user being supplied during a social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
- Affected versions
-
max 1.7.8.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2024-27957
- CVE, Research URL
- Date
- Mar 17, 2024
- Research Description
- Unrestricted Upload of File with Dangerous Type vulnerability in Pie Register.This issue affects Pie Register: from n/a through 3.8.3.1.
- Affected versions
-
max 3.8.3.3.
- Status
-
vulnerable
Jul 10, 2024
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2024-6069
- CVE, Research URL
- Date
- Jul 09, 2024
- Research Description
- The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregister_install_addon function in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins. As a result attackers might achieve code execution on the targeted server
- Affected versions
-
max 3.8.3.5.
- Status
-
vulnerable
Feb 23, 2025
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2024-13818
- CVE, Research URL
- Date
- Feb 21, 2025
- Research Description
- The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.4 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in the exposed log files.
- Affected versions
-
max 3.8.4.1.
- Status
-
vulnerable
Jul 12, 2025
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2025-34077
- CVE, Research URL
- Date
- Jul 09, 2025
- Research Description
- An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.
- Affected versions
-
max 3.7.1.5.
- Status
-
vulnerable
Jan 27, 2026
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2026-24577
- CVE, Research URL
- Date
- Jan 23, 2026
- Research Description
- Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pie Register: from n/a through <= 3.8.4.8.
- Affected versions
-
max 3.8.4.9.
- Status
-
vulnerable
Apr 13, 2026
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2026-3571
- CVE, Research URL
- Date
- Apr 04, 2026
- Research Description
- The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pie_main() function in all versions up to, and including, 3.8.4.8. This makes it possible for unauthenticated attackers to change registration form status.
- Affected versions
-
max 3.8.4.9.
- Status
-
vulnerable
Jun 16, 2026
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # 66eca9df42cfca7572aa02a8543ccceb9d6b1e97
- CVE, Research URL
- Date
- Oct 21, 2021
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 3.7.2.4 WordPress Pie Register plugin <= 3.7.2.3 - Open Redirect vulnerability Open Redirect vulnerability discovered by WPScanTeam in WordPress Pie Register plugin (versions <= 3.7.2.3).
- Affected versions
-
max 3.7.2.4.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # 42c6370cf8669accad1f7095a691382cb74052b8
- CVE, Research URL
- Date
- Oct 29, 2018
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 3.0.18 WordPress Pie Register plugin <= 3.0.17 - Unauthenticated Cross-Site Scripting (XSS) vulnerability Unauthenticated Cross-Site Scripting (XSS) vulnerability found by Alvaro J. Gene in WordPress Pie Register plugin (versions <= 3.0.17).
- Affected versions
-
max 3.0.18.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # 73f4d955d2d3cf45113429d98e209b959f27bfe5
- CVE, Research URL
- Date
- Jul 04, 2015
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 2.0.16 WordPress Pie Register Plugin <= 2.0.15 - SQL Injection Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Update the plugin.
- Affected versions
-
max 2.0.16.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # 986409d80688f8b1af317e915c3f587fe9a40ab8
- CVE, Research URL
- Date
- Oct 21, 2021
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 3.7.2.4 Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments <= 3.7.2.3 - Open Redirect The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments plugin for WordPress is vulnerable to Open Redirects in versions up to, and including, 3.7.2.3. This is due to insufficient validation on the redirect url supplied via the 'redirect_to' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Affected versions
-
max 3.7.2.4.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # 115c6d4911d178cbf5289d92127e2518573cfc00
- CVE, Research URL
- Date
- Mar 09, 2015
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 2.0.15 Pie Register < 2.0.15 - Cross-Site Scripting The Pie Register plugin for WordPress is vulnerable to Cross-Site Scripting via the 'notice' parameter in versions before 2.0.15 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
- Affected versions
-
max 2.0.15.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # 9f44c424c939432dde455f11bf721718aa4f60ea
- CVE, Research URL
- Date
- Jul 04, 2015
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 2.0.15 WordPress Pie Register Plugin <= 2.0.14 - Cross Site Scripting Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.
- Affected versions
-
max 2.0.15.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # 47be6034f05f13bddd45a45c0b52fc3ead307de9
- CVE, Research URL
- Date
- Jul 04, 2015
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 2.0.16 WordPress Pie Register Plugin <= 2.0.15 - Privilege Escalation This plugin is prone to an privilege escalation vulnerability. Update the plugin.
- Affected versions
-
max 2.0.16.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # f6788a0ab7bb01a74bea16f0dcd22ec268db8d0d
- CVE, Research URL
- Date
- May 04, 2015
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] >= 2.0.14 - <= 2.0.15 Registration Forms – User Profile, Custom Registration Form, Login Form, Invitation-Based Registrations for WordPress 2.0.14 - 2.0.15 - Authentication Bypass The Registration Forms – User Profile, Custom Registration Form, Login Form, Invitation-Based Registrations plugin for WordPress is vulnerable to authentication bypass in versions 2.0.14 - 2.0.15 . This is due to a lack of validation of user input in a login request to the plugin. This makes it possible for unauthenticated attackers to authenticate as an administrator when supplying a site administrators user id.
- Affected versions
-
Min 2.0.14, max 2.0.15.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # ab8d4d1fd3ce7482816c18db08d68c18196c69e5
- CVE, Research URL
- Date
- Jun 20, 2018
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 3.0.10 WordPress Pie Register plugin <= 3.0.9 - Authenticated Blind SQL Injection (SQLi) vulnerability Authenticated Blind SQL Injection (SQLi) vulnerability found by Manuel Garcia Cardenas WordPress Pie Register plugin (versions <= 3.0.9).
- Affected versions
-
max 3.0.10.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # 0b942974fb47c0522c8353bbf94700f8476e4ec9
- CVE, Research URL
- Date
- Oct 24, 2018
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 3.0.18 Pie Register < 3.0.18 - Unauthenticated Cross-Site Scripting The Pie Register plugin for WordPress is vulnerable to Cross-Site Scripting in versions before 3.0.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
- Affected versions
-
max 3.0.18.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # 184214b039944ab26a07c5bf9abf25d7c009b971
- CVE, Research URL
- Date
- May 04, 2015
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] >= 2.0.14 - <= 2.0.15 Pie Register 2.0.14-2.0.15 - SQL Injection The Pie Register plugin for WordPress is vulnerable to SQL Injection via the show_dash_widget’ and ‘invitaion_code’ parameter in versions 2.0.14-2.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
- Affected versions
-
Min 2.0.14, max 2.0.15.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # 2a05ebe6-ad16-4070-90ae-be600cfe2b08
- CVE, Research URL
- Date
- -
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 3.0.18 Pie Register <= 3.0.17 - Unauthenticated Cross-Site Scripting (XSS) The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by an Unauthenticated Cross-Site Scripting (XSS) security vulnerability.
- Affected versions
-
max 3.0.18.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # f0b9e57d-e319-415d-8333-48586c111108
- CVE, Research URL
- Date
- -
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 2.0.16 Pie Register 2.0.14-2.0.15 - SQL Injection User input is not validated correctly when accepting an Invitation Code, as such an SQL Injection attack is possible. This attack is triggered when the parameters ‘show_dash_widget’ and ‘invitaion_code’ are provided to any page, by any user (anonymous or otherwise).
- Affected versions
-
max 2.0.16.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # 44b6576c-2989-4b8e-8662-07c85c0028c2
- CVE, Research URL
- Date
- -
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 2.0.15 Pie Register <= 2.0.14 - Cross-Site Scripting (XSS) The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
- Affected versions
-
max 2.0.15.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # f30f77bd-2e6e-45cd-ac02-c9d3985844da
- CVE, Research URL
- Date
- -
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 2.0.16 Pie Register 2.0.14-2.0.15 - Privilege Escalation User input is not validated correctly when accepting a login request via the Pie Register plugin. It is possible to manipulate posted variables in order to login using an arbitrary User ID (such as 1, for the default Administrative account).
- Affected versions
-
max 2.0.16.
- Status
-
vulnerable
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # f6efa32f-51df-44b4-bbba-e67ed5785dd4
- CVE, Research URL
- Date
- -
- Research Description
- Pie Register – User Registration, Profiles & Content Restriction [pie-register] < 3.7.2.4 Pie Register < 3.7.2.4 - Open Redirect The plugin passes unvalidated user input to the wp_redirect() function, without validating it, leading to an Open redirect issue
- Affected versions
-
max 3.7.2.4.
- Status
-
vulnerable
Jun 24, 2026
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Conten # CVE-2026-10530
- CVE, Research URL
- Date
- Jun 22, 2026
- Research Description
- The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.
- Affected versions
-
max 3.8.4.10.
- Status
-
vulnerable