Description
The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Pie Register | ≤ 3.8.4.15 | — |
References
- https://wpscan.com/vulnerability/0501d724-f5cf-4b71-a463-0ab86b2ea8b5/ exploit vdb-entry technical-description