CVE-2026-96962 is an information exposure vulnerability (CWE-200) in the Pie Register WordPress plugin prior to version 3.8.4.14. The plugin does not properly restrict access to an invitation-code report, enabling unauthenticated attackers who possess a valid invitation code to retrieve sensitive user information including usernames and email addresses of all users registered with that code. This exposure could lead to privacy violations and facilitate further attacks such as phishing or targeted social engineering.

The vulnerability exposes personally identifiable information (usernames and email addresses) of users registered with a specific invitation code to unauthenticated parties. This can compromise user privacy and potentially aid attackers in crafting targeted attacks. There is no indication of remote code execution or privilege escalation, but the information disclosure itself is significant.

Users of the Pie Register plugin should upgrade to version 3.8.4.14 or later, where this vulnerability is fixed. Since the affected versions are prior to 3.8.4.14, applying the official update will restrict access to the invitation-code report and prevent unauthorized information disclosure. No other mitigation guidance is provided or necessary.