Pie Register Premium: unauthenticated unrestricted file upload (CVE-2026-84999)
A vulnerability, CVE-2026-84999 (CVSS 9.8), was published for the Pie Register Premium plugin for WordPress. The piereg_file_upload function does not check the result of file type validation, and its AJAX handler has no nonce or capability check.
Checked in Shield: no
Who is affected
All versions of Pie Register Premium up to and including 3.8.4.0 are affected. An unauthenticated attacker can upload dangerous files such as PHP scripts, which may lead to remote code execution, since the server returns the uploaded file's path.
How to check
In the WordPress admin, open the Plugins page and see whether Pie Register Premium is installed and which version it is. Version 3.8.4.0 or lower is affected.
How to fix
A fixed version is not named in the source yet. Watch the vendor's announcements and update as soon as a patch is released. Until then, consider temporarily deactivating the plugin.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
The fixed version and any real-world exploitation are not disclosed yet. Source: NVD (CVE-2026-84999).
