CVE-2022-4024: Pie Register < 3.8.1.3 - Unauthenticated Arbitrary User Deletion

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-19 · updated 2026-06-17
Weakness: CWE-352

Description

The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)

Affected products

genetechproducts Pie Register – User Registration, Profiles & Content Restriction: before 3.8.1.3 — fixed in 3.8.1.3

How to fix

Upgrade to a fixed version: genetechproducts Pie Register – User Registration, Profiles & Content Restriction 3.8.1.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe
https://wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe

Get alerted when CVE-2022-4024 or the next vulnerability affects your stack