Pie Register Premium: Unrestricted file upload in piereg_file_upload
Summary
The Pie Register Premium WordPress plugin up to and including 3.8.4.0 does not stop dangerous file types in its piereg_file_upload AJAX handler, because it ignores validation errors and performs no nonce or capability check. An unauthenticated attacker can upload executable files such as PHP scripts and then trigger them using the destination filename returned by the server, which may lead to remote code execution. The vulnerability is rated Critical (CVSS 9.8) by the CNA, while VulDB rates it High (7.3).
Affected
- Pie Register Premium plugin for WordPress, versions 0 to 3.8.4.0 inclusive
- The free Pie Register plugin is a separate package; it is not confirmed as affected or unaffected by this CVE.
Fixed in
Unknown. No fixed premium version or vendor advisory was found at the time of research.
Workaround
Unknown. The vendor has published no workaround.
- Deactivate and remove the premium plugin if its registration features are not required.
- Block script execution in WordPress upload directories at the web server level.
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV.
- Public proof of concept: conflicting reports. VulDB states no exploit is available; no working exploit was confirmed.
- CISA SSVC: automatable yes, technical impact total.
Our recommendation
- Inventory all WordPress sites for Pie Register Premium at version 3.8.4.0 or lower.
- Deactivate and remove the plugin where registration features are not needed; isolate affected sites where possible.
- Check upload and plugin directories for unexpected PHP or other executable files and review logs for requests to the plugin's AJAX handler; look for webshells.
- Apply the vendor fix as soon as it is released and monitor the vendor and Wordfence for updates.
- Use a WAF or virtual patch only if your provider can confirm it covers this flaw.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- Pie Register website pieregister.com
- Strix CVE record www.strix.ai
- VulDB entry vuldb.com
- OffSeq radar entry radar.offseq.com
- The Hacker Wire entry www.thehackerwire.com
- Positive Technologies record (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:18.
Original description (NVD)
The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_and_ext but never checking whether those validation calls produced errors before move_uploaded_file() is called, combined with no nonce or capability check on the AJAX handler. This makes it possible for unauthenticated attackers to upload files of dangerous types (e.g. PHP scripts) that may be executable, which makes remote code execution possible. The server returns the generated destination filename in the response, giving the attacker the exact path needed to trigger the uploaded file.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.