CVE-2026-84999
Received Received - Intake

Unrestricted File Upload in Pie Register Premium Plugin

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: Wordfence

Description
The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_and_ext but never checking whether those validation calls produced errors before move_uploaded_file() is called, combined with no nonce or capability check on the AJAX handler. This makes it possible for unauthenticated attackers to upload files of dangerous types (e.g. PHP scripts) that may be executable, which makes remote code execution possible. The server returns the generated destination filename in the response, giving the attacker the exact path needed to trigger the uploaded file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-84999
EUVD
EUVD-2026-111559

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Pie Register Pie Register Premium 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Pie Register Premium plugin for WordPress has an unrestricted file type upload vulnerability in versions up to 3.8.4.0. The plugin fails to properly validate file types before processing uploads, allowing attackers to upload dangerous files like PHP scripts. It also lacks proper authentication checks on the upload handler, enabling unauthenticated remote code execution. The server response reveals the exact file path, letting attackers execute the uploaded malicious file.

Detection Guidance

Check for unauthorized PHP or executable files in WordPress upload directories, particularly those created recently. Review server logs for unusual file upload activity or requests to /wp-admin/admin-ajax.php with file upload parameters. Use commands like find /path/to/uploads -type f -name "*.php" -mtime -7 to locate suspicious files.

Impact Analysis

This vulnerability allows attackers to upload and execute malicious files on your server, potentially taking full control of your WordPress site. It can lead to data theft, defacement, malware distribution, or further compromise of your server and network. Unauthorized code execution means attackers can perform any action with the same privileges as the web server.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR, HIPAA, and other regulations due to unauthorized data access, breaches, or loss of sensitive information. It may result in legal penalties, fines, reputational damage, and mandatory breach notifications. Organizations must ensure proper security controls to maintain compliance.

Mitigation Strategies

Immediately update the Pie Register Premium plugin to the latest version beyond 3.8.4.0. If an update is unavailable, disable the plugin entirely. Restrict write permissions on WordPress upload directories and scan for malicious files. Implement a web application firewall to block file upload exploits.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84999. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart