PatchTheCVEBlog · Daily digest · 2026-10-28
CVE-2026-84999 Pie Register Premium plugin: critical remote flaw, how to fix
By the PatchTheCVE security team · Updated 2026-10-28 · Data from NVD, CISA KEV, EPSS and vendor advisories
Critical severity (CVSS 9.8), remotely exploitable, no login needed. Recommended action: apply the vendor mitigation.
On 28 October 2026, 51 new CVEs were published that we track: 3 critical, 0 already exploited in the wild (CISA KEV) and 5 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.
Key takeaways
- Most urgent: CVE-2026-84999 (Pie Register Premium plugin): apply the vendor mitigation.
- 6 of the top 8 can be attacked over the network without a login.
- 5 of 51 new CVEs already have a fix or vendor patch.
- Most affected vendors: a2ui-project, bplugins, codepeople.
What happened on 28 October 2026: the most serious item is CVE-2026-84999 (critical, CVSS 9.8, priority 39/100). Recommended action: apply the vendor mitigation. 6 of the 8 top items can be attacked remotely without a login. Most affected: a2ui-project (2), bplugins (1), codepeople (1). 5 of 51 new CVEs already have a fix or vendor patch; for the other 46, follow the downgrade or mitigation steps until one ships.
Patch these first
CVE-2026-84999: The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions u
- Risk: Critical (CVSS 9.8), priority 39/100 (patch this month), published 28 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-106013: The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login
- Risk: Critical (CVSS 9.8), priority 39/100 (patch this month), published 28 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-110879: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes insid
- Risk: Critical (CVSS 9.8), priority 39/100 (patch this month), published 28 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-111314: The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to
- Risk: High (CVSS 7.2), priority 35/100 (routine), published 28 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action; on your watchlist.
References: NVD
CVE-2026-118375: llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdm
- Risk: High (CVSS 8.1), priority 33/100 (routine), published 28 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-1928: The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Inj
- Risk: High (CVSS 8.8), priority 31/100 (routine), published 28 October 2026
- Affected: rankmath rank math seo ai seo tools to dominate seo rankings (<= 1.0.276)
- Fixed in: newer than 1.0.276
- What to do: upgrade to newer than 1.0.276 for rankmath rank math seo ai seo tools to dominate seo rankings
Why it ranks here: high severity.
References: NVD
CVE-2026-111255: The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to
- Risk: High (CVSS 7.5), priority 31/100 (routine), published 28 October 2026
- Affected: cservit affiliate-toolkit multi-network affiliate amazon product display (<= 3.9.2)
- Fixed in: newer than 3.9.2
- What to do: upgrade to newer than 3.9.2 for cservit affiliate-toolkit multi-network affiliate amazon product display
Why it ranks here: high severity; on your watchlist.
References: NVD
CVE-2026-118377: mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows un
- Risk: High (CVSS 7.5), priority 31/100 (routine), published 28 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
Most affected vendors
- a2ui-project: 2 new CVEs
- bplugins: 1 new CVE
- codepeople: 1 new CVE
- cservit: 1 new CVE
- linux: 1 new CVE
- rankmath: 1 new CVE
How to act on this list
- Start with anything marked exploited or patch now.
- Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
- Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
- Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.
FAQ
What is the most serious vulnerability published on 28 October 2026?
CVE-2026-84999 (The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions u) ranks highest, with a priority score of 39/100. Recommended action: apply the vendor mitigation.
Are any of the new CVEs exploited in the wild?
None of the new CVEs were on the CISA Known Exploited Vulnerabilities list when this was written. Keep watching the list, it changes daily.
Should I downgrade if there is no fix yet?
Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.
Sources
- NIST National Vulnerability Database: CVE details and affected versions
- CVE Program: official CVE records
- CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
- FIRST EPSS: exploit probability
- Distribution and vendor advisories linked under each item.