User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload
criticalThe User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected s...
- CVSS:
- 9.8
- Affected:
- up to 1.6.20
- Fixed in:
- 1.6.21
- Disclosed:
- May 1, 2026