What is the CVSS score of CVE-2026-4882?

CVE-2026-4882 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of User Registration Advanced Fields are affected by CVE-2026-4882?

User Registration Advanced Fields plugin for WordPress versions 1.6.20 and earlier contain a critical file upload vulnerability allowing unauthenticated attackers to execute arbitrary code on…

How to fix or mitigate CVE-2026-4882?

Within 24 hours: Identify all WordPress instances using User Registration Advanced Fields plugin ≤1.6.20 via plugin inventory audit; immediately disable the Profile Picture form field feature in all active registration forms. Within 7 days: Contact plugin vendor regarding patch timeline and evaluate alternative registration plugins without this vulnerability; implement Web Application Firewall rules to block file uploads to vulnerable plugin directories (/wp-content/plugins/user-registration-advanced-fields/). Within 30 days: If no vendor patch is released, uninstall the plugin entirely and migrate user registration workflows to alternative solutions, or upgrade to patched version if released by vendor.

User Registration Advanced Fields CVE-2026-4882

EUVD-2026-26734 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-02 security@wordfence.com

WordPress File Upload RCE

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 05:30 vuln.today

EUVD ID Assigned

May 02, 2026 - 05:22 euvd

EUVD-2026-26734

Analysis Generated

May 02, 2026 - 05:22 vuln.today

CVE Published

May 02, 2026 - 05:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a "Profile Picture" field is added to the form.

AnalysisAI

Unrestricted file upload in User Registration Advanced Fields plugin for WordPress (≤1.6.20) allows remote unauthenticated attackers to upload executable files and achieve code execution on the web server when Profile Picture fields are enabled in registration forms. Wordfence has documented this critical vulnerability affecting all versions through 1.6.20, with exploitation possible against any site using the Profile Picture form field feature without authentication or user interaction required.

Technical ContextAI

The vulnerability resides in the URAF_AJAX::method_upload function which handles file uploads for the WordPress User Registration Advanced Fields plugin. This function fails to implement server-side file type validation before accepting uploaded files through the Profile Picture field component. CWE-434 (Unrestricted Upload of File with Dangerous Type) represents a critical input validation failure where applications accept files without verifying content type, extension, or executable characteristics. In WordPress environments, successful upload of PHP files to web-accessible directories enables direct code execution through HTTP requests to the uploaded file path. The plugin extends WP User Registration functionality to add custom fields including profile pictures, resume uploads, and other file-based inputs to registration forms.

RemediationAI

Upgrade to User Registration Advanced Fields version 1.6.21 or later once available (exact patched version not confirmed in provided intelligence - verify with vendor at wpuserregistration.com). Until patching is possible, remove or disable Profile Picture fields from all user registration and profile forms as an immediate compensating control; this eliminates the attack surface entirely but removes legitimate profile picture functionality for users. Alternatively, implement web application firewall (WAF) rules to block file uploads with executable extensions (.php, .phtml, .php5, .phar) to the plugin's upload handler endpoints, though this may be bypassable via null-byte injection or double-extension techniques. Review existing uploads directory (typically wp-content/uploads/user-registration/) for suspicious PHP files uploaded prior to mitigation. Consult Wordfence Threat Intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c6a377-216f-4d61-8fae-ec5bc2793cdf for updated remediation guidance and detection indicators.