Security notice

WordPress site using Pie Register Premium? Anyone can upload a PHP file. Update to 3.8.4.1 today.

Last updated: Saturday, October 31, 2026, 12:42 PM ETStatus: Fix released. No attacks reported yet. Update or deactivate today.

Pie Register Premium is a paid WordPress plugin for registration and login forms. On October 27, 2026, security firm Patchstack listed a critical flaw in it, and the CVE record, published October 28 by Wordfence, rates it 9.8 out of 10. Versions up to and including 3.8.4.0 let anyone, with no account, upload files to your website, including PHP code, which can lead to remote code execution, meaning a stranger running their own commands on your server. Version 3.8.4.1 fixes it. We found no report of attacks, and CISA does not list it as exploited, but Patchstack says flaws like this are "expected to become exploited" in mass attacks. If your site runs Pie Register Premium, update it through your Pie Register license or deactivate it today, then check your site for unexpected files and administrators. We could not confirm whether the free Pie Register plugin is affected.

What happened

What the flaw is. The CVE record says the plugin's piereg_file_upload function accepts file uploads from anyone, with no login. It says the plugin checks the type of each uploaded file but never looks at whether those checks failed before it saves the file, so a file type that should have been refused, such as a PHP script, is saved anyway. It also says the upload handler has no security token or permission check, and that the server's reply gives the new file's exact location, which tells the attacker where to find it. (CVE record, Rapid7)
Why that is serious. A PHP file that an attacker can upload and then open in a browser is code running on your web server. The CVE record says this "makes remote code execution possible." Patchstack lists the privilege needed as "Unauthenticated," meaning none, and calls the flaw highly dangerous. (CVE record, Patchstack)
Affected and fixed versions. Pie Register Premium 3.8.4.0 and earlier. Patchstack lists 3.8.4.1 as the patched version. The CVE record scores it CVSS 9.8, which is 9.8 out of 10. (Patchstack, CVE record)
When it was published. Patchstack published its entry on October 27, 2026. Wordfence, which assigned the CVE number, published the CVE record on October 28. (Patchstack, CVE record)
No attacks reported yet. Neither the CVE record nor Patchstack says the flaw is being exploited, and we found no report that it is. CISA KEV does not list it in its version dated October 29, 2026, and Rapid7 shows it as not on that list. Patchstack says: "This vulnerability is highly dangerous and expected to become exploited. Vulnerabilities like this one are used in mass-exploit campaigns." That is Patchstack's prediction, not a report of attacks. (Patchstack, Rapid7, CISA KEV)
The free Pie Register plugin: not confirmed. The CVE record, Patchstack and Rapid7 name only Pie Register Premium. We could not confirm whether the free Pie Register plugin from WordPress.org has the same flaw. We can say that the WordPress.org page for the free plugin currently reads "This plugin has been closed as of October 28, 2026 and is not available for download. This closure is temporary, pending a full review." It gives no reason, and we do not know whether the closure is related to this flaw. (WordPress.org)

Who should worry

This is about WordPress websites that use the paid Pie Register Premium plugin, often for member sign-up, user profiles or login forms. If you are not sure whether your site uses it, ask your web developer or agency. Ask about this if any of these are true:

Your WordPress site uses Pie Register Premium and is on version 3.8.4.0 or earlier.
Your site uses Pie Register (the free version) and you have not heard from the plugin's makers whether it is affected.
An agency or developer built your member or registration pages and you do not know which plugin runs them.
You run a web agency or host and look after WordPress sites for clients.

If your site does not use Pie Register, this notice does not apply to you.

What to do now

Do these today.

Check if you have it. In your WordPress dashboard, open Plugins, then Installed Plugins, and look for "Pie Register Premium." Note the version number. If it says 3.8.4.1 or higher, you have the fix.
Update, or deactivate. Update Pie Register Premium to 3.8.4.1 or later. Premium plugins are usually updated through the maker's license account, not WordPress.org, so use your Pie Register license to get the update. Take a backup first. If you cannot update today, deactivate the plugin until you can. Patchstack's advice is to update the plugin, and to ask your host or developer for help if you cannot. (Patchstack)
Check for a break-in. Because the upload needed no login, ask your developer or host to look for PHP files in wp-content/uploads and its folders. That folder should hold images and documents, so any .php file there that you do not recognize is a red flag. Also check the list of administrators under Users and look for unfamiliar ones, and for plugins or themes you did not install. This is our advice, not from the CVE record. A site that was exposed before it was updated needs this check most.
If you find something, treat the site as compromised: call your developer or host, restore from a clean backup, update everything, and change all passwords, including WordPress administrator accounts, hosting and database logins.
Ask your host to block PHP in the uploads folder. Many hosts can stop the web server from running PHP files inside wp-content/uploads. That does not fix this flaw, but it makes this kind of flaw much less useful to an attacker. This is our advice.
If you use the free Pie Register plugin, ask the plugin's makers whether it is affected, and watch the WordPress.org page for news. We do not know yet.
Check your site afterwards. Test your registration and login forms, and any pages that use the plugin.

What to send your developer, agency or host

Pie Register Premium 3.8.4.0 and earlier has a critical flaw, CVE-2026-84999 (CVSS 9.8): an unauthenticated PHP file upload through the piereg_file_upload AJAX handler that can lead to remote code execution. It is fixed in 3.8.4.1, according to Patchstack, which published it on October 27, 2026. Please tell us whether our site uses Pie Register Premium and which version it is on. If it is 3.8.4.0 or earlier, please update it to 3.8.4.1 or later today, or deactivate the plugin until you can. Please also check wp-content/uploads and its subfolders for .php files that do not belong, check the administrator list for accounts we do not recognize, and confirm that PHP cannot run from the uploads folder. If we use the free Pie Register plugin, please find out from its makers whether it is affected. Sources: Patchstack, CVE record.

Common questions

Has my site been hacked?

This notice does not mean your site has been hacked. It means a critical flaw is public and a fix is out. We found no report of attacks yet, but Patchstack expects them, so update before they start.

Can EverThread tell me if I am affected?

No. EverThread does not test for this flaw. We check your home page from the outside, the way a browser sees it. We cannot see which WordPress plugins your site runs, which version they are on, or what files are on your server. If our scan does not warn you about this, that does not mean you are safe. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

Does this affect the free Pie Register plugin?

We do not know. The CVE record and Patchstack name only Pie Register Premium. WordPress.org shows the free plugin as temporarily closed since October 28, 2026, pending a full review, and gives no reason. Ask the plugin's makers. (CVE record, Patchstack, WordPress.org)

How do I update a premium plugin?

Premium plugins usually do not update from WordPress.org. Sign in to your Pie Register license account to get 3.8.4.1 or later, or ask your developer to do it. If you cannot update today, deactivate the plugin.

Where can I follow official updates?

The Patchstack entry and the CVE record are the public records. All current notices are on our notices page.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

Patchstack: Pie Register Premium plugin 3.8.4.0, unauthenticated arbitrary file upload vulnerability, October 27, 2026, checked October 29, 2026
CVE Program: CVE-2026-84999, published by Wordfence on October 28, 2026, checked October 29, 2026
Rapid7: CVE-2026-84999, checked October 29, 2026
WordPress.org: Pie Register plugin page, checked October 29, 2026
CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 29, 2026, checked October 29, 2026