{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pie-register-premium--3.8.4.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pieregister:pie_register_premium:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-84999"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-84999\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Pie Register Premium (\u003c= 3.8.4.0)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","remote-code-execution","web-application-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Pie Register"],"content_html":"\u003cp\u003ePie Register Premium for WordPress, in all versions up to and including 3.8.4.0, contains an unrestricted file upload vulnerability (CVE-2026-84999). The piereg_file_upload function performs file type validation calls using wp_check_filetype and wp_check_filetype_and_ext but fails to verify the return status of these functions before calling move_uploaded_file. Furthermore, the AJAX handler lacks both nonce verification and capability checks, enabling unauthenticated remote code execution. Successful exploitation results in the server returning the full path to the uploaded file, allowing immediate remote execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to upload and execute arbitrary scripts, such as PHP backdoors, on the host web server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Pie Register Premium to a version later than 3.8.4.0 immediately.\u003c/li\u003e\n\u003cli\u003eImplement the detection rule below to identify exploitation attempts targeting the file upload endpoint.\u003c/li\u003e\n\u003cli\u003eAudit the uploads directory for unexpected PHP or other executable files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T04:39:15Z","date_published":"2026-10-28T04:19:11Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pie-register-rce/","summary":"The Pie Register Premium WordPress plugin contains an unrestricted file upload vulnerability in the piereg_file_upload function that allows unauthenticated attackers to achieve remote code execution.","title":"Pie Register Premium: Unrestricted file upload remote code execution (CVE-2026-84999)","url":"https://feed.craftedsignal.io/briefs/2026-10-pie-register-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Pie Register Premium (\u003c= 3.8.4.0)","version":"https://jsonfeed.org/version/1.1"}