Pie Register Premium Flaw Lets Anyone Upload Files and Take Over WordPress Sites: Update to 3.8.4.1

TL;DR: Pie Register Premium, a paid WordPress plugin for custom registration and login forms, has a critical flaw (CVE-2026-84999, CVSS 9.8) that lets anyone upload files to the site without logging in, which can lead to a full takeover. Versions 3.8.4.0 and earlier are affected. Wordfence lists 3.8.4.1 as the fixed version; Pie Register hasn’t published a public release note we could find. If you use Pie Register Premium, update now.

What happened

On October 27, 2026, Wordfence published an advisory for CVE-2026-84999 in Pie Register Premium, credited to the researcher Chu Thao Mai, and updated it on October 28. NVD received the record on October 28 at 11:17 a.m. Manila time.

According to Wordfence, the plugin’s file upload handler (the piereg_file_upload request) runs without checking who is asking, and it moves the file into place even when its own file-type check fails. The response then tells the uploader where the file landed. An attacker can upload a PHP file and run it, which gives them control of the site. Wordfence rates the flaw 9.8 out of 10.

Wordfence’s advisory marks the flaw patched and says “Update to version 3.8.4.1.” We couldn’t find a changelog for 3.8.4.1 on Pie Register’s website, so the fixed version on this page is Wordfence’s. Wordfence’s record names only the Premium plugin. Pie Register also publishes a free plugin on WordPress.org, now at version 3.8.4.15; whether it shares the flaw is not confirmed, so check with Pie Register.

Why it matters

Registration plugins sit on public pages by design, so the vulnerable code is easy for attackers to reach. Uploading a file and running it is one of the most direct ways to take over a WordPress site: from there, an attacker can steal member and customer data, add spam or malware, or use the server to attack others. Premium plugins also update through a license key rather than WordPress.org, and expired licenses are a common reason sites fall behind.

What to do now

1. Check your version. In WordPress, go to Plugins and find Pie Register Premium. If an agency or developer manages the site, ask them.
2. Update to 3.8.4.1 or later. That’s the version Wordfence lists as the fix. Premium updates need an active license; if yours has lapsed, contact Pie Register.
3. Deactivate it if you can’t update today. Our advice: a short break in sign-ups costs less than a hacked site. Your host or firewall provider may also be able to block the upload request.
4. Look for signs of trouble. Our advice: check wp-content/uploads for script files you didn’t add, and look for new admin accounts. If you find anything, treat the site as compromised.

Also on WordPress this week: Jupiter X Core CVE-2026-106013 lets attackers log in as admin. For another file-upload attack on small online shops, see our coverage of Adobe Commerce and Magento CVE-2026-48356. Our Security hub tracks the rest.

Updates

• Oct 28, 2026, 3:07 p.m. Manila: First published. We’ll add a dated note if Pie Register publishes a release note or attacks are reported.

Sources & method

Sources

• Wordfence advisory for CVE-2026-84999 (Wordfence, published Oct 27, updated Oct 28, 2026)
• NVD record for CVE-2026-84999 (NVD, Oct 28, 2026)
• Pie Register website and the free Pie Register plugin on WordPress.org (Pie Register)

Method. Checked October 28, 2026, at 1:15 p.m. Manila time (05:15 UTC). The flaw description, affected and patched versions, CVSS score and researcher credit come from Wordfence; the NVD date comes from the NVD record. We looked for a Pie Register release note for 3.8.4.1 on its website and found none. We checked CISA’s Known Exploited Vulnerabilities catalog. Steps labelled “our advice” are our own judgment, not Wordfence’s or Pie Register’s. The thumbnail is Pie Register’s own banner from its WordPress.org plugin page. No affiliate links on this page. How we work.