PT-2026-36566 · WordPress · User Registration Advanced Fields

Jude Nwadinobi · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-4882

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions User Registration Advanced Fields versions prior to 1.6.21

Description The User Registration Advanced Fields plugin for WordPress allows unauthenticated attackers to upload arbitrary files to the server. This issue stems from missing file type validation within the method upload() function of the 'URAF AJAX' class, which could lead to remote code execution. This flaw is only exploitable if a "Profile Picture" field has been added to the registration form.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-4882

Affected Products

User Registration Advanced Fields

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-4882 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f2c6a377-216f-4d61-8fae-ec5bc2793cdf?source=cve · Note
• https://wpuserregistration.com/features/advanced-fields · Note
• https://twitter.com/KaitanSecurity/status/2050447700206752094 · Twitter Post
• https://twitter.com/OrizonCyber/status/2050447721727705187 · Twitter Post