Two critical WordPress plugin holes to check for this week

If your WordPress site uses Pie Register Premium or the Jupiter X theme, check it today. Two serious security holes in those plugins went public on October 28, 2026.

Both are rated 9.8 out of 10, which is about as high as these scores go. Neither one needs the attacker to have an account on your site. Below is what each hole does and what to do about it.

Pie Register Premium: strangers can upload files to your site

Pie Register is a plugin for custom sign-up and login forms. Its paid version, Pie Register Premium, includes a file upload feature, and that's where the problem is.

The official CVE record explains it. The plugin checks whether an uploaded file is a safe type, then saves the file whether it passed or not. Anyone on the internet can send it a file, and the plugin even replies with the file's location. If that file is a PHP script, the attacker can run it and take over the site.

Every version up to and including 3.8.4.0 is affected. As of this morning, I couldn't find a fixed version. Watch the Wordfence advisory and the Pie Register site for one.

Don't let an older fix fool you. Pie Register had a different upload hole earlier, fixed in version 3.8.3.3, per Patchstack. Being on 3.8.3.3 or later doesn't protect you from this new one.

What to do:

• In WordPress, go to Plugins and look for Pie Register Premium and its version number.
• Check for an update in WordPress and on the Pie Register site.
• If there's no update yet, deactivate the plugin until one ships. Your custom forms will stop working for a few days, which beats handing a stranger your server.

Jupiter X: someone can log in as you through the X button

Jupiter X is a popular WordPress theme. It comes with a helper plugin called Jupiter X Core, which runs on more than 70,000 sites according to WordPress.org. One of its features lets visitors sign in with their X (formerly Twitter) account.

That sign-in had a mix-up. When a visitor came back from X, the plugin asked X who they were using the site owner's X credentials instead of the visitor's. X answered with the site owner's profile, and the plugin logged the visitor in as the matching WordPress user. That's usually the admin. The CVE record has the technical details.

This only matters if X login is turned on. Most sites never set it up.

Versions up to and including 4.61.0 are affected. There's some good news here. Jupiter X Core 4.62.0 came out on October 22, and its changelog on WordPress.org says it fixed a security issue. Since the hole only reaches 4.61.0, updating should close it. The changelog doesn't name this hole, though, so I'd keep X login off until Wordfence or Artbees, the theme's maker, confirms it.

What to do:

• Update Jupiter X Core to 4.62.0 or newer.
• If your login form has a "Sign in with X" button, remove it or turn off X login for now.
• If X login was on, look under Users for admin accounts you don't recognize, and change your admin password.

Are attackers using these yet?

Nobody has reported attacks so far. Both holes are listed with no known attacks and no public attack code, per TheHackerWire. That can change fast. Attackers started using last week's PHP2Shell hole within a day of the fix, which I covered in my PHP2Shell post.

Not sure what your site runs?

If you don't know which plugins your site uses, or you'd rather not touch the settings yourself, send me a message. I can go through your plugin list with you and tell you whether either hole applies.

This post covers the facts as of October 28, 2026. Check for plugin updates again before you act.