CVE-2024-13818: Pie Register Information Disclosure Flaw

CVE-2024-13818 Overview

CVE-2024-13818 affects the Pie Register plugin for WordPress, marketed as Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction. The plugin exposes sensitive information through publicly accessible log files in all versions up to and including 3.8.4. Unauthenticated attackers can retrieve these log files over the network and view user data captured during plugin operations. The flaw is classified as Insertion of Sensitive Information into Log File [CWE-532] and stems from log files stored in a web-accessible location without access controls.

Critical Impact

Unauthenticated remote attackers can read user information from exposed plugin log files without authentication or user interaction.

Affected Products

• Genetechsolutions Pie Register plugin for WordPress, all versions up to and including 3.8.4
• WordPress sites running the Registration Forms plugin variant from the same vendor
• Sites that have generated log files via the plugin in default install paths

Discovery Timeline

• 2025-02-21 - CVE-2024-13818 published to the National Vulnerability Database (NVD)
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-13818

Vulnerability Analysis

The Pie Register plugin writes operational data to log files that reside in directories served by the web server. Because no access control or randomization protects these files, anyone who knows or guesses the path can download them. The log content may include personally identifiable information about registrants, invitation tokens, or other user metadata processed by the plugin. The weakness maps to [CWE-532], which covers placement of sensitive information into log files that are not adequately protected.

The attack requires no authentication and no user interaction. An attacker only needs network access to the target WordPress site to issue HTTP GET requests against the log path.

Root Cause

The root cause is the plugin's logging implementation defined in the base variable configuration referenced in classes/base_variables.php. The log directory and filenames are predictable and reside under the plugin's web-accessible directory. The plugin does not place a restrictive .htaccess, web.config, or index.php guard inside the log directory, nor does it move logs outside the document root. As a result, log files inherit the default permissive web access of the WordPress installation.

Attack Vector

Exploitation proceeds over the network against the public WordPress site. An attacker enumerates the plugin's known log file paths under wp-content/plugins/pie-register/ or related upload paths and retrieves the files with standard HTTP clients. No credentials, cookies, or session state are required. The attacker then parses the log entries to extract user data. See the WordPress Plugin Code Reference for the path construction logic and the Wordfence Vulnerability Analysis for additional technical context.

No verified public proof-of-concept code is available for this issue, so exploitation is described in prose rather than with synthetic examples.

Detection Methods for CVE-2024-13818

Indicators of Compromise

• HTTP GET requests from external IP addresses targeting wp-content/plugins/pie-register/ paths ending in .log, .txt, or similar log extensions
• Repeated 200 OK responses to unauthenticated requests for plugin log files in web server access logs
• Access patterns that enumerate directories under the Pie Register plugin folder without preceding authentication events

Detection Strategies

• Search web server access logs for unauthenticated requests to Pie Register log file paths and flag responses with non-zero content length
• Inventory all WordPress installations and report any running Pie Register version at or below 3.8.4
• Use file integrity monitoring on the plugin directory to alert when log files are created in web-accessible locations

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized analytics platform and alert on access to plugin-internal file types from public sources
• Monitor outbound data volume from WordPress hosts for spikes consistent with bulk log file retrieval
• Track Wordfence and WPScan vulnerability feeds for additional indicators tied to the Pie Register plugin

How to Mitigate CVE-2024-13818

Immediate Actions Required

• Update the Pie Register plugin to a version newer than 3.8.4 as published by Genetechsolutions in the WordPress Plugin Changeset Record
• Remove or relocate any existing log files generated by the plugin from web-accessible directories
• Review log contents already produced and notify affected users if personal data was exposed

Patch Information

The vendor addressed the issue in the changeset referenced above, which modifies the log handling logic from classes/base_variables.php. Administrators should apply the latest Pie Register release through the WordPress plugin updater or by replacing the plugin files manually. Confirm the installed version after upgrade and verify that legacy log files are removed.

Workarounds

• Block direct web access to plugin log files by adding a deny rule for *.log requests under wp-content/plugins/pie-register/ in the web server configuration
• Place an .htaccess file with Require all denied (Apache) or equivalent location directives (Nginx) in the plugin's log directory
• Deactivate the Pie Register plugin until the patched version can be deployed if updates cannot be applied promptly

# Apache: deny public access to Pie Register log files
<FilesMatch "\.(log|txt)$">
    Require all denied
</FilesMatch>

# Nginx: equivalent location block in the server config
location ~* /wp-content/plugins/pie-register/.*\.(log|txt)$ {
    deny all;
    return 403;
}