CVE-2024-27957: 
WordPress vulnerability analysis and mitigation

The Pie Register WordPress plugin contains an Unrestricted Upload of File with Dangerous Type vulnerability, identified as CVE-2024-27957. The vulnerability affects versions through 3.8.3.1 and was discovered by Rafie Muhammad. The issue was publicly disclosed on March 13, 2024, and received a critical CVSS v3.1 score of 10.0 (Patchstack).

The vulnerability exists in the pie_save_registration function due to missing file type validation. This security flaw manifests when the 'Anyone can register' option is enabled in options-general and the 'Upload File' field is added to the registration form. The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 to 10.0, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating critical severity (NVD, Patchstack).

The vulnerability allows unauthenticated attackers to upload arbitrary files to the affected site's server, potentially enabling remote code execution. This presents a significant security risk as attackers could upload malicious files including backdoors to gain further access to the website (WPScan).

The vulnerability is highly dangerous and expected to become mass exploited. It requires no authentication and can be exploited when specific configuration conditions are met, namely the 'Anyone can register' option being enabled and the 'Upload File' field being present in the registration form (Patchstack).

The vulnerability has been fixed in version 3.8.3.3 of the Pie Register plugin. Users are strongly advised to update to this version or later immediately. For those unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until the update can be applied (Patchstack).