Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-84999— Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler

Quick assessment

Affected
Pie Register Pie Register Premium
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Pie Register Premium 插件在所有 3.8.4.0 及之前的版本中，存在“不受限制的文件类型上传”漏洞。该漏洞源于插件通过 和 进行文件类型验证，但在调用 之前从未检查这些验证调用是否返回错误；同时，其 AJAX 处理器也未实施 nonce 验证或权限（capability）检查。这使得未认证的攻击者能够上传危险类型的文件（例如可执行的 PHP 脚本），从而可能实现远程代码执行。此外，服务器会在响应中返回生成的目标文件名，使攻击者获得触发已上传文件所需的精确路径。

CVSS 9.8 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84999

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler
Source: CVE Program / CVE List V5
Vulnerability Description
The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_and_ext but never checking whether those validation calls produced errors before move_uploaded_file() is called, combined with no nonce or capability check on the AJAX handler. This makes it possible for unauthenticated attackers to upload files of dangerous types (e.g. PHP scripts) that may be executable, which makes remote code execution possible. The server returns the generated destination filename in the response, giving the attacker the exact path needed to trigger the uploaded file.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Pie Register Pie Register Premium 0 ~ 3.8.4.0 -

II. Public POCs for CVE-2026-84999

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84999

请登录查看更多情报信息。

Vendor Pages for CVE-2026-84999 (1)

Other References for CVE-2026-84999 (1)

IV. Related Vulnerabilities

Same product: Pie Register Premium
Same vendor: Pie Register
Same weakness: CWE-434