Technical impact
This vulnerability is a missing authorization flaw that allows an attacker to bypass intended access controls within the Pie Register Premium plugin. The flaw could enable a user without proper permissions to invoke privileged actions or view protected data, thereby undermining the confidentiality, integrity, or availability of the WordPress site. The weakness is mapped to CWE‑862, categorizing it as a broken access control issue.
Affected Systems
WordPress installations running Pie Register Premium plugin versions up through 3.8.3.2 are affected. The vulnerability applies to all environments that have not yet upgraded to at least 3.8.3.3, regardless of the website’s user role configuration.
Risk and Exploitability
The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The issue is not listed in the CISA KEV catalog. Exploitation would likely require that the attacker is authenticated or has compromised credentials but may still allow privilege escalation within the plugin’s feature set. No additional details about attack prerequisites are disclosed, so the attack vector is inferred rather than explicitly stated.
EUVD