What the vulnerability does
01Description
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a "Profile Picture" field is added to the form.
Explanation of Vulnerability in Simple Terms
02Summary
User Registration Advanced Fields versions 1.6.20 and earlier allow unauthenticated attackers to upload arbitrary files to the site without restriction. An attacker can upload malicious files—including PHP scripts—directly through the plugin, gaining the ability to run code on the server. No user interaction or authentication is required. This vulnerability affects all installations of the plugin up to version 1.6.20.
What an attacker can do
03Attacker Capabilities
Upload and execute arbitrary files, including PHP code, on the site without authentication.
Potential impact on your site
04Site Impact
Complete compromise of the site; attacker can run code, steal data, modify content, or take the site offline.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 2, 2026
CVE published
May 4, 2026
Record updated
