CVE-2026-24577

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24577", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-23T12:32:02.839Z", "datePublished": "2026-01-23T14:28:57.456Z", "dateUpdated": "2026-04-28T16:14:49.762Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "pie-register", "product": "Pie Register", "vendor": "Genetech Products", "versions": [{"changes": [{"at": "3.8.4.9", "status": "unaffected"}], "lessThanOrEqual": "3.8.4.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Mdr | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:54.312Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Pie Register: from n/a through <= 3.8.4.8.</p>"}], "value": "Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pie Register: from n/a through <= 3.8.4.8."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:49.762Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/pie-register/vulnerability/wordpress-pie-register-plugin-3-8-4-7-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Pie Register plugin <= 3.8.4.8 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T21:27:42.933029Z", "id": "CVE-2026-24577", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:28:58.233Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24577", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T21:27:42.933029Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T21:28:04.633Z"}}], "cna": {"title": "WordPress Pie Register plugin <= 3.8.4.8 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Mdr | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Genetech Products", "product": "Pie Register", "versions": [{"status": "affected", "changes": [{"at": "3.8.4.9", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.8.4.8"}], "packageName": "pie-register", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:54.312Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/pie-register/vulnerability/wordpress-pie-register-plugin-3-8-4-7-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pie Register: from n/a through <= 3.8.4.8.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Pie Register: from n/a through <= 3.8.4.8.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:06.772Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24577", "state": "PUBLISHED", "dateUpdated": "2026-04-28T14:28:58.233Z", "dateReserved": "2026-01-23T12:32:02.839Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-23T14:28:57.456Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "pie-register", "product": "Pie Register", "vendor": "Genetech Products", "versions": [{"changes": [{"at": "3.8.4.9", "status": "unaffected"}], "lessThanOrEqual": "3.8.4.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pie Register: from n/a through <= 3.8.4.8."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en Genetech Products Pie Register pie-register permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Pie Register: desde n/a hasta &lt;= 3.8.4.7."}], "id": "CVE-2026-24577", "lastModified": "2026-06-17T10:23:16.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24577", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T21:27:42.933029Z", "version": "2.0.3"}}]}, "published": "2026-01-23T15:16:15.480", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/pie-register/vulnerability/wordpress-pie-register-plugin-3-8-4-7-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T01:40:11.349565+00:00", "value": {"mitigation_remediation": ["Upgrade Pie Register to the latest patched version (any release after 3.8.4.8).", "If an upgrade is not immediately possible, disable or remove the Pie Register plugin for all non\u2011administrator users to eliminate the exposed functionality.", "As a temporary workaround, restrict the plugin\u2019s endpoint URLs to the administrator role using a custom permission filter or a security plugin that blocks access from non\u2011admin accounts."], "summary": {"action": "Update Plugin", "impact": "Authorization Bypass"}, "threat_synthesis": {"affected_systems": "Affected products are Genetech Products Pie Register, a WordPress plugin. All versions up to and including 3.8.4.8 are impacted, as the issue exists from inception through the indicated latest version. No other product or platform versions are listed in the CVE data.", "description_and_impact": "The vulnerability is a missing authorization requirement in the Pie Register plugin for WordPress. Because the plugin does not enforce proper access control, users with insufficient privileges can exploit the component to perform actions that should be restricted, potentially allowing them to read or modify data that should be protected. This weakness is classified as CWE\u2011862, reflecting a broken access control flaw.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests that the vulnerability is currently underutilized. The attack vector is likely a web\u2011based interaction with a WordPress site, with an attacker needing the ability to send crafted requests to the plugin\u2019s endpoints. If an attacker can authenticate with a user account that has elevated privileges or can manipulate the request parameters, the missing checks can be leveraged to perform unauthorized actions. The lack of an entry in CISA\u2019s KEV catalog means no publicly known exploits are confirmed, but the moderate CVSS indicates that once exploited, the impact could include unauthorized data access or modification."}}}}, "created": "2026-01-26T11:53:06.647095+00:00", "updated": "2026-04-16T01:45:20.657715+00:00", "vendors": ["genetech_products", "genetech_products$PRODUCT$pie_register", "wordpress", "wordpress$PRODUCT$wordpress"]}