The Pie Register plugin for WordPress lacks a capability check in the pie_main() function in all releases up to 3.8.4.8. This flaw permits any unauthenticated user to submit requests that alter the registration form status, effectively changing how new users register on the site. The unauthorized modification represents a data integrity issue and a privilege escalation vector, allowing attackers to enable or disable registration forms without permission. The identified weakness corresponds to CWE‑862, Unauthorized Access – Privilege Escalation.

WordPress sites that use the Genetechproducts Pie Register – User Registration, Profiles & Content Restriction plugin. Vulnerable versions are all releases up to and including 3.8.4.8; any installation on a WordPress site running those versions is affected.

The CVSS score of 6.5 indicates a medium‑to‑high severity vulnerability. Although no EPSS score is provided and the issue is not listed in CISA’s KEV catalog, the lack of authentication makes it theoretically exploitable by any external actor reaching the plugin’s endpoints. The likely attack path involves sending crafted requests to the registration form status endpoint, which the plugin processes without verifying user capabilities.