Unrestricted File Type Upload Vulnerability in Pie Register Premium Plugin for WordPress

CVE-2026-84999

What is CVE-2026-84999?

The Pie Register Premium plugin exposes a significant security flaw due to unrestricted file type uploads. This vulnerability allows unauthenticated attackers to upload malicious files, such as PHP scripts, without proper validation checks, effectively enabling remote code execution. The plugin inadequately verifies file types during upload and fails to implement necessary nonce or capability checks on the AJAX handler, which further compromises the security. Once an attacker successfully uploads a file, the server provides the destination path in the response, allowing easy access to trigger the malicious file.

References