WordPress Plugin Exploits Blocked: Three New WAF Rules

BitNinja has released three new WAF rules for WAF2 and WAF Pro after three serious WordPress threats surfaced this week. Two rules target vulnerable plugins. The third blocks requests to a WordPress directory that should never be accessible over HTTP.

For hosting providers and server owners, these threats share a significant risk factor: they can be triggered remotely without authentication.

BitNinja customers receive this protection automatically through new rules.

Rule 406063: Pie Register Premium arbitrary file upload

CVE-2026-84999 affects Pie Register Premium versions up to 3.8.4.0. The vulnerability allows an unauthenticated attacker to upload arbitrary files.

The fixed version is 3.8.4.1.

Sites using Pie Register Premium should be upgraded to that version as soon as possible.

Rule 406064: Ultimate Member PHP object injection

CVE-2026-115968 affects Ultimate Member versions up to 2.13.1. The plugin has more than 200,000 active installs, and the vulnerability has a CVSS score of 9.8.

The issue is an unauthenticated PHP object injection vulnerability. A remote attacker can send a crafted request without logging in, which can lead to serious compromise depending on the affected site and its environment.

Ultimate Member 2.14.0 contains the fix.

Rule 401010: Block access to the WordPress upgrade directory

Rule 401010 takes a broader approach. It blocks HTTP requests to the wp-content/upgrade directory, including when WordPress is installed in a subdirectory.

WordPress uses this location to unpack update packages on disk. Browsers and external clients do not need to request files from that path. Blocking HTTP access therefore removes an unnecessary route to staged update files.

The issue affects WordPress core versions 4.7 through 7.1.3 and was fixed in version 7.1.4, with backports available. During an update, attackers try to reach a staged copy of setup-config.php before the update process finishes.

What hosting teams should do

Keep the WAF rules enabled, then patch the affected software:

• Upgrade Pie Register Premium to 3.8.4.1 or later.

• Upgrade Ultimate Member to 2.14.0 or later.

• Upgrade WordPress core to 7.1.4 or a release containing the applicable backport.

• Review customer installations for outdated plugin and core versions.

• Monitor requests to vulnerable plugin endpoints and WordPress upgrade paths.

WAF protection reduces exposure during the period between vulnerability disclosure and patch deployment. It does not replace updates. Once the affected software is patched, the site no longer depends on the vulnerable code being present, while Rule 401010 continues to prevent direct requests to a directory that should remain private.