CVE-2026-4882: User Registration Advanced Fields WordPress Plugin Unrestricted File Upload
CVE-2026-4882 affects the User Registration Advanced Fields plugin for WordPress, where missing file type validation in the URAF_AJAX::method_upload function can allow unauthenticated arbitrary file uploads. The record rates it 9.8 (critical) under CVSS 3.1 and notes that exploitation requires a Profile Picture field in a form. No fixed version appears in the sources consulted, and the CVE is not listed in CISA KEV.
Overview
CVE-2026-4882 is an unrestricted file upload weakness (CWE-434) in the User Registration Advanced Fields plugin for WordPress. According to the record, the upload handler URAF_AJAX::method_upload does not validate file types in versions up to and including 1.6.20.
Impact
The record states that an unauthenticated attacker could upload arbitrary files to the affected server, which may make remote code execution possible. The CVSS 3.1 vector reported by Wordfence (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) corresponds to a base score of 9.8.
Affected products and versions
- Product: User Registration Advanced Fields plugin for WordPress.
- Versions: all versions up to and including 1.6.20, according to the record.
- Condition: the vulnerability can only be exploited if a Profile Picture field is added to the form.
- Fixed versions: none are listed in the record. This does not mean no fix exists. Check the vendor page and the Wordfence entry.
Exploitation status
The record shows the CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00869 with a percentile of 0.57697, dated 2026-10-13 in the record.
Remediation and mitigation
- Identify whether the plugin is installed and which version is active.
- Check whether any form uses a Profile Picture field, since the record ties exploitation to that configuration.
- Apply a vendor update once a version that addresses the issue is published. The sources consulted do not name one.
- Until an update is available, consider temporarily removing the Profile Picture field or restricting public registration forms, and validate the impact before changing production sites.
- Restrict upload permissions at the web server and file system level, and keep upload directories out of executable paths where practical.
Detection guidance
- Review web server logs for unexpected requests to the plugin's AJAX upload handler from unauthenticated sources.
- Look for newly created files with unexpected extensions in upload directories, and for unfamiliar scripts within WordPress directories.
- Monitor for changes to plugin files and for unexpected administrative accounts.
Limitations of the available information
The record does not include a fixed version, a vendor patch identifier, or a detailed technical analysis of the upload handler. Whether a specific site is vulnerable depends on local configuration, which the record does not describe. The EPSS figure is a probability estimate, not evidence of exploitation.
Frequently asked questions
What is CVE-2026-4882?
It is an unrestricted file upload vulnerability (CWE-434) in the User Registration Advanced Fields plugin for WordPress, caused by missing file type validation in URAF_AJAX::method_upload.
Does exploitation require any special configuration?
Yes. According to the record, the vulnerability can only be exploited if a Profile Picture field is added to the form.
Is there a fixed version?
The record does not list a fixed version. This does not mean no fix exists, so check the vendor page and the Wordfence entry for updates.
Is this CVE known to be actively exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.