The Pie Register WordPress plugin fails to enforce authentication or authorization on a request handler, effectively allowing any web user to trigger a reset of the plugin’s settings to factory defaults and to delete the plugin’s data table. This weakness is a classic authentication bypass (CWE-284) that jeopardizes both the integrity of user registration controls and the persistence of user data.

Vulnerable installations include the Pie Register plugin version 3.8.4.15 and any earlier releases. The plugin is hosted within WordPress environments where the plugin is active; no specific operating system or WordPress version is required beyond the plugin’s own constraints.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the potential impact is high because the flaw permits unauthenticated users to alter critical security settings and erase data. An attacker can simply issue an unauthenticated HTTP request to the affected handler to execute the reset or data destruction. No additional software or privileges are needed beyond standard web access to the site hosting the plugin.