CVE-2026-84999: Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler
The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the pieregfileupload function. This is due to the plugin performing file type validation via wpcheckfiletype and wpcheckfiletypeandext but never checking whether those validation calls produced errors before moveuploadedfile() is called, combined with no nonce or capability check on the AJAX handler. This makes it possible for unauthenticated attackers to upload files of dangerous types (e.g. PHP scripts) that may be executable, which makes remote code execution possible. The server returns the generated destination filename in the response, giving the attacker the exact path needed to trigger the uploaded file.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can target the affected AJAX handler. No account, nonce, or WordPress capability is required.
What conditions are needed for remote code execution?
The attacker must be able to upload a dangerous file type, such as a PHP script, and the server must permit that uploaded file to be executed. The handler returns the generated destination filename, allowing the attacker to locate the uploaded file.
Which installations are affected?
Pie Register Premium versions up to and including 3.8.4.0 are affected. The issue is in the piereg_file_upload AJAX handler and does not depend on an authenticated user configuration.
How can defenders check for exploitation?
Review uploads and web-server logs for requests to the piereg_file_upload AJAX handler, especially unauthenticated requests. Investigate unexpected uploaded executable files and requests to newly generated upload paths.