CVE-2026-4882: User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAFAJAX::methodupload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a "Profile Picture" field is added to the form.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4882?
CVE-2026-4882 is classified as a critical vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2026-4882?
To fix CVE-2026-4882, upgrade the User Registration Advanced Fields plugin to version 1.6.21 or later.
What does CVE-2026-4882 affect?
CVE-2026-4882 affects the User Registration Advanced Fields plugin for WordPress versions up to and including 1.6.20.
Can CVE-2026-4882 be exploited remotely?
Yes, CVE-2026-4882 can be exploited remotely due to its unauthenticated nature.
What are the consequences of CVE-2026-4882?
Exploitation of CVE-2026-4882 can allow attackers to upload arbitrary files, which may lead to code execution or data breaches.