CVE-2026-84999 is a critical (CVSS 9.8) unrestricted file upload flaw in the Pie Register Premium WordPress plugin. Unauthenticated attackers can use it to upload executable files such as PHP scripts, which can lead to remote code execution.
What Is It
The bug is in the plugin's piereg_file_upload function and is classed as CWE-434, Unrestricted Upload of File with Dangerous Type. The plugin runs file type validation through wp_check_filetype and wp_check_filetype_and_ext. However, it never checks whether those calls returned errors before it calls move_uploaded_file(). So the validation runs, but its result is ignored.
The AJAX handler behind this function also has no nonce check and no capability check. This means anyone can reach it without logging in.
Why It Matters
According to the NVD record, unauthenticated attackers can upload dangerous file types such as PHP scripts, and those files may be executable. This makes remote code execution possible.
The server also returns the generated destination filename in its response. That gives the attacker the exact path needed to trigger the uploaded file, so they don't have to guess where it landed.
The CVSS 3.1 vector rates this flaw as easy to reach and severe in impact, with the impact confined to the vulnerable component (Scope: Unchanged):
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Access: network, low attack complexity, no privileges, no user interaction
- Scope: unchanged
- Impact: high for confidentiality, integrity and availability
No CISA KEV entry was supplied for this CVE. Active exploitation is not confirmed by KEV at this time. The NVD record status is "Deferred."
What's Vulnerable
- Vendor: Pie Register
- Product: Pie Register Premium (WordPress plugin)
- Affected versions: All versions up to and including 3.8.4.0
The NVD record lists no specific CPEs. The vulnerability was reported by Wordfence ([email protected]).
Patch Status
The supplied NVD data does not name a fixed version. It only says that all versions up to and including 3.8.4.0 are affected. No KEV entry was supplied, so there is no CISA-mandated required action or due date.
Administrators running Pie Register Premium 3.8.4.0 or earlier should:
- Check the vendor and Wordfence advisories listed below for the current fix status.
- Update to a release later than 3.8.4.0 once the vendor confirms it fixes the issue.