The User Registration Advanced Fields plugin for WordPress suffers from an unrestricted file upload vulnerability (CWE-434) due to lack of file type validation in the 'URAF_AJAX::method_upload' function. This flaw allows unauthenticated attackers to upload arbitrary files to the server when a 'Profile Picture' field is included in the form, potentially enabling remote code execution. The vulnerability affects all versions up to and including 1.6.20. The CVSS 3.1 base score is 9.8, reflecting critical severity with network attack vector and no required privileges or user interaction. No patch or official fix has been published as of the data provided.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the affected WordPress site, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is critical due to its ease of exploitation and the potential for full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider removing or disabling the 'Profile Picture' field in registration forms to prevent exploitation. Monitoring for suspicious file uploads and restricting file upload permissions may also help reduce risk, but these are not guaranteed mitigations for this vulnerability.