The User Registration Advanced Fields plugin for WordPress lacks file type validation in the URAF_AJAX::method_upload function, allowing attackers to upload arbitrary files on the server. This vulnerability can enable remote code execution if the attacker uploads a malicious script. The flaw is identified as CWE-434, classifying it as an arbitrary file upload weakness.

WPEverest’s User Registration Advanced Fields plugin, all releases up to and including version 1.6.20, is affected. Sites that have installed this plugin and use the "Profile Picture" field in their registration form are susceptible.

With a CVSS score of 9.8, the vulnerability is considered critical. EPSS data is unavailable, and it is not yet listed in CISA’s KEV catalog. Exploitation requires an unauthenticated attacker and the presence of a profile picture field on the form; the upload endpoint can be targeted by a crafted request to place malicious files on the host, potentially leading to remote code execution.