Pie Register Premium: Unrestricted file upload remote code execution (CVE-2026-84999)

Pie Register Premium for WordPress, in all versions up to and including 3.8.4.0, contains an unrestricted file upload vulnerability (CVE-2026-84999). The piereg_file_upload function performs file type validation calls using wp_check_filetype and wp_check_filetype_and_ext but fails to verify the return status of these functions before calling move_uploaded_file. Furthermore, the AJAX handler lacks both nonce verification and capability checks, enabling unauthenticated remote code execution. Successful exploitation results in the server returning the full path to the uploaded file, allowing immediate remote execution.

Impact

Successful exploitation allows an unauthenticated attacker to upload and execute arbitrary scripts, such as PHP backdoors, on the host web server.

Recommendation

• Update Pie Register Premium to a version later than 3.8.4.0 immediately.
• Implement the detection rule below to identify exploitation attempts targeting the file upload endpoint.
• Audit the uploads directory for unexpected PHP or other executable files.