CVE-2026-3571: 
WordPress vulnerability analysis and mitigation

CVE-2026-3571 is a Missing Authorization vulnerability in the Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress. It affects all versions up to and including 3.8.4.8, allowing unauthenticated attackers to modify registration form status via a missing capability check on the pie_main() function. The vulnerability was published on April 4, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-862 (Missing Authorization) — the pie_main() function in the Pie Register plugin does not perform any capability or permission check before executing privileged actions, allowing any network-accessible request to trigger it. Because no authentication or privilege is required (attack vector: Network, attack complexity: Low, privileges required: None, user interaction: None), an unauthenticated attacker can send a crafted HTTP request to the WordPress site to invoke this function and alter registration form configuration. A patch was committed to the plugin's SVN repository (changeset 3494602) (GitHub Advisory, Plugin Changeset).

Successful exploitation allows unauthenticated attackers to modify or disable user registration forms on affected WordPress sites, directly compromising the integrity of the registration workflow and potentially preventing legitimate users from registering. The vulnerability carries low integrity and low availability impact with no confidentiality impact, meaning sensitive data is not directly exposed, but site functionality and user onboarding can be disrupted. There is no evidence of lateral movement potential beyond the plugin's registration form management scope (GitHub Advisory, Wordfence).

As of the time of reporting, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.016% (9th percentile), indicating a low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

The primary remediation is to upgrade the Pie Register plugin beyond version 3.8.4.8 to the patched release, which includes the fix committed in changeset 3494602 (Plugin Changeset). If an immediate upgrade is not possible, consider temporarily disabling the Pie Register plugin or restricting access to WordPress admin-facing endpoints via web application firewall (WAF) rules. Additionally, monitor registration form status and configuration for unauthorized changes as a compensating control (Wordfence).