CVE-2026-10530

Medium · 5.3

CVSS

5.3

EPSS

0.2%

Published

Jun 22, 2026

CISA due date

—

The record

The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.

Affected packages

Ecosystem	Package	Introduced	Fixed