CVE-2026-4882: WordPress Plugin Arbitrary File Upload Critical Flaw
The User Registration Advanced Fields plugin for WordPress, in all versions up to and including 1.6.20, is vulnerable to arbitrary file uploads. This critical flaw, identified as CVE-2026-4882, stems from a complete lack of file type validation within the URAF_AJAX::method_upload function, according to the National Vulnerability Database.
This vulnerability allows unauthenticated attackers to upload arbitrary files to the affected site’s server. The immediate consequence is a high probability of remote code execution (RCE), giving attackers full control over the compromised WordPress instance. The National Vulnerability Database assigns this a CVSS score of 9.8 (CRITICAL), underscoring the severe impact and ease of exploitation.
Crucially, this vulnerability is not a default configuration issue; it can only be exploited if a “Profile Picture” field has been added to a form within the plugin. This configuration detail is vital for defenders to assess their exposure. The attacker’s calculus here is straightforward: find unpatched WordPress sites with this specific plugin and form field, upload a web shell, and gain RCE.
What This Means For You
- If your organization uses the User Registration Advanced Fields plugin for WordPress, check its version immediately. If you are running version 1.6.20 or earlier, and have a "Profile Picture" field enabled on any form, your site is critically exposed. Patch or disable the plugin without delay, and audit your server logs for any suspicious file uploads or unexpected new files.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-4882: WordPress User Registration Advanced Fields Arbitrary File Upload
title: CVE-2026-4882: WordPress User Registration Advanced Fields Arbitrary File Upload
id: scw-2026-05-02-ai-1
status: experimental
level: critical
description: |
Detects the specific AJAX action 'uraf_upload_file' used by the User Registration Advanced Fields plugin to upload files. This is the primary indicator of exploitation for CVE-2026-4882, allowing unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-4882/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/wp-admin/admin-ajax.php'
cs-uri-query|contains:
- 'action=uraf_upload_file'
cs-method:
- 'POST'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-4882 | RCE | User Registration Advanced Fields plugin for WordPress |
| CVE-2026-4882 | Arbitrary File Upload | User Registration Advanced Fields plugin for WordPress versions <= 1.6.20 |
| CVE-2026-4882 | Arbitrary File Upload | Missing file type validation in 'URAF_AJAX::method_upload' function |
| CVE-2026-4882 | Attack Vector | Exploitable if a 'Profile Picture' field is added to the form |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 02, 2026 at 08:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
WordPress Profile Builder Pro: Unauthenticated PHP Object Injection Risks Site Takeover
CVE-2026-7647 — The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is...
PixelYourSite Pro Plugin SSRF Vulnerability (CVE-2026-7049)
CVE-2026-7049 — The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to,...
CVE-2026-6916 — Cross-Site Scripting (XSS)
CVE-2026-6916 — The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site...