The Pie Register Premium vulnerability, found in a plugin added to WordPress website software, received a CVSS 3.1 severity score of 9.8 out of 10 in the entry published on October 28, 2026 by the National Vulnerability Database (NVD), the public vulnerability repository maintained by the U.S. National Institute of Standards and Technology (NIST). If your site uses this plugin in version 3.8.4.0 or earlier, have its status checked now and watch for a fix from the publisher.
What is it?
The CVE-2026-84999 vulnerability allows an unauthenticated user, meaning someone without an account or password, to upload dangerous files to a WordPress site running this plugin.
Think of a cottage closed up for the winter: the front door is locked and the key put away, but the garage door is left wide open and nobody checks on it. That’s the nature of this flaw. The plugin, used to register members on a site, does run a check on the type of file being uploaded. But it never acts on the result of its own check. According to the NVD entry’s description, a dangerous file can then be saved on the server. This opens the door to remote code execution: an attacker can run their own instructions on the machine hosting your site.
Why is it serious?
The CVSS 3.1 severity score is 9.8 out of 10 in the NVD entry, assigned by the reporting organization (CNA). No exploitation has been reported to date in this entry.
In business terms, a hijacked site means pages altered under your name, or customer information siphoned off through registration forms. Your site could also become a relay for distributing malware to your own visitors. A personal information breach triggers obligations in Quebec, including keeping an incident register and, depending on severity, notifying the Commission d’accès à l’information (Quebec’s privacy regulator).
The fact that no attack has been reported doesn’t mean none will happen. It’s like the smoke detector in the hallway: you check the battery without knowing whether there will ever be a fire.
Who is affected?
The affected product is Pie Register Premium, from publisher Pie Register, in all versions up to and including 3.8.4.0.
No fixed version is specified in the NVD entry or in the public material reviewed: this is missing information as of now, to be obtained from the publisher. The plugin is used to manage member registration and accounts on a WordPress site. The entries don’t document which organizations use it. As possible examples, this type of tool is found wherever a visitor can create an account: clinics, clubs or associations, businesses with a customer portal, non-profit organizations, professional practices.
How do I check my business?
Opening the plugin list on the site and reading the installed version is enough to know whether you’re affected.
- Have someone open the WordPress dashboard, Plugins section, to see whether Pie Register Premium is installed and which version is running (management, with the person who manages the site).
- If the version is 3.8.4.0 or earlier, deactivate the plugin if the site can function without it (IT provider).
- Check the publisher’s website to see whether a fixed version is available (IT provider or software vendor).
- Have recently uploaded files in the upload folders identified, and back up the site before any intervention (webmaster or hosting provider).
Scenario
Fictional example: no real business is depicted in this story.
A regional dental clinic offers patients an online portal to request appointments. The site was built three years ago, and the registration plugin hasn’t been touched since. One morning, the homepage shows unfamiliar content and visitors’ browsers flag the site as dangerous. The day turns into a string of calls: the hosting provider, the webmaster, patients needing reassurance. In this story, nobody knew which version of the plugin was running on the site, or who was responsible for it.
What the Pie Register Premium Vulnerability Means Here
For an organization in Quebec or elsewhere in Canada, the website is often the commercial front door and the place where personal information passes through. A forgotten plugin therefore becomes a matter of business continuity, not just an IT detail. Let’s be clear: no protection is absolute, and be wary of any claim promising total protection. What works are the basic measures recommended by the Canadian Centre for Cyber Security, applied consistently.
What to do now
- Check whether the plugin is present and which version is running on each of your sites.
- Back up the entire site, and test that the backup restores properly.
- Deactivate the plugin if your site can do without it, until a fix is released.
- Update as soon as the publisher releases a fixed version, then have the version number in use confirmed in writing.
- Schedule a recurring plugin review, with a named person responsible.
FAQ
Our site is small, would an attacker really target it?
We have no evidence of targeting specific to this vulnerability. Generally speaking, some scanning for vulnerable sites is automated, and a small organization isn’t excluded on that basis: that’s part of why the Canadian Centre for Cyber Security publishes baseline controls aimed at small and medium organizations. Size mainly affects how much impact an organization can absorb.
No attack has been reported. Can we wait until the site redesign?
The NVD entry shows no exploitation to date, and we won’t speculate beyond that. But a score of 9.8 out of 10 places this vulnerability near the top of the CVSS 3.1 scale. Checking the installed version doesn’t require touching the redesign project.
Who should handle this in our organization?
Management decides and sets the timeline. Checking the version happens in the site’s dashboard, done by whoever administers it. Updating, backing up, and reviewing uploaded files fall to the IT provider or hosting provider.
Sources
- CVE-2026-84999 entry, National Vulnerability Database · NIST, October 28, 2026
- Security advisory (pieregister.com) · pieregister.com
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · baseline control checklist
- Commission d’accès à l’information du Québec · obligations, incident register, and notification
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-84999
This article was prepared by RISS Canada’s monitoring team based on the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial standards.
