This vulnerability exists because the Pie Register WordPress plugin, up to version 3.8.4.15, lacks an authorization check on one of its AJAX actions. As a result, users with a role as low as contributor can modify invitation‑code records that were created by administrators. The flaw allows a non‑admin user to change data that is normally restricted to higher‑privileged accounts, potentially facilitating unauthorized access or impersonation. The impact is an elevation of privilege within the WordPress environment.

Any WordPress site that has installed the Pie Register plugin at a version no later than 3.8.4.15 is affected. The vulnerability is specific to the plugin’s administrative invitation‑code functionality and is not tied to the core WordPress software.

The exploit does not require any special conditions beyond an authenticated contributor account, making it straightforward to execute. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the absence of a formal exploitation probability does not diminish the risk posed by an earnest attacker. The CVSS score is not supplied; nevertheless, the lack of an authorization check combined with the low role threshold results in a high severity risk in the absence of mitigation. The attack vector is most likely through the web interface via the injected AJAX request, and the vulnerability is exploitable from any location where the WordPress instance is reachable.