Pie Register Premium
Monthly
Unauthenticated attackers can upload arbitrary files - including PHP scripts - through the piereg_file_upload AJAX handler in the Pie Register Premium WordPress plugin in every version up to and including 3.8.4.0, and the server returns the generated destination filename in its response, handing the attacker the exact URL needed to trigger the uploaded file and potentially achieve remote code execution. The upload path enforces neither a nonce nor a capability check, and the results of wp_check_filetype/wp_check_filetype_and_ext are never inspected before move_uploaded_file() runs, so the type filter provides no effective barrier. No KEV entry or public exploit reference was supplied with this record; however, the vulnerability.today decision label is act_now and the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), with the practical limit on full RCE being whether the target upload directory is web-accessible and executes PHP.
Unauthenticated attackers can upload arbitrary files - including PHP scripts - through the piereg_file_upload AJAX handler in the Pie Register Premium WordPress plugin in every version up to and including 3.8.4.0, and the server returns the generated destination filename in its response, handing the attacker the exact URL needed to trigger the uploaded file and potentially achieve remote code execution. The upload path enforces neither a nonce nor a capability check, and the results of wp_check_filetype/wp_check_filetype_and_ext are never inspected before move_uploaded_file() runs, so the type filter provides no effective barrier. No KEV entry or public exploit reference was supplied with this record; however, the vulnerability.today decision label is act_now and the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), with the practical limit on full RCE being whether the target upload directory is web-accessible and executes PHP.