WordPress - User Registration Advanced Fields - CRITICAL - CVE-2026-4882. The User Registration Advanced Fields plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation within the 'URAF_AJAX::method_upload' function. This flaw affects all versions up to 1.6.20. If a 'Profile Picture' field is enabled, unauthenticated attackers could exploit this vulnerability to upload arbitrary files to the server, potentially leading to remote code execution.