CVE-2026-4882
published 2026-05-02CVE-2026-4882: The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the…
PriorityP271critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.65%
46.6th percentile
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a "Profile Picture" field is added to the form.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wpeverest | user_registration_advanced_fields | <= 1.6.20 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
WPEverest User Registration Advanced Fields Plugin up to 1.6.20 on WordPress URAF_AJAX::method_upload unrestricted upload
vuldb·2026-05-02·CVSS 9.8
CVE-2026-4882 [CRITICAL] WPEverest User Registration Advanced Fields Plugin up to 1.6.20 on WordPress URAF_AJAX::method_upload unrestricted upload
A vulnerability was found in WPEverest User Registration Advanced Fields Plugin up to 1.6.20 on WordPress and classified as critical. This impacts the function URAF_AJAX::method_upload. The manipulation results in unrestricted upload.
This vulnerability was named CVE-2026-4882. The attack may be performed from remote. There is no available exploit.
GHSA
GHSA-97v3-45f3-3pwq: The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJ
ghsa_unreviewed·2026-05-02
CVE-2026-4882 [CRITICAL] CWE-434 GHSA-97v3-45f3-3pwq: The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJ
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a "Profile Picture" field is added to the form.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-02
Published