The Pie Register plugin for WordPress suffers from a missing capability check in the pie_main() function, which leads to unauthorized modification of registration form status by unauthenticated attackers. This vulnerability is tracked as CVE-2026-3571 and is classified under CWE-862 (Missing Authorization). It affects all versions up to and including 3.8.4.8. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but low integrity and low availability impacts.

An attacker without authentication can modify the registration form status, potentially disrupting user registration processes or altering form behavior. There is no impact on data confidentiality. The integrity and availability of the registration form data can be affected, which may lead to denial of service or unauthorized changes in registration workflows.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin's functionalities where possible and monitor for unusual changes to registration forms. Avoid exposing the plugin to untrusted users or networks. Follow vendor channels for updates on patches or official mitigations.