The User Registration Advanced Fields plugin for WordPress contains a critical vulnerability allowing unauthenticated attackers to upload arbitrary files due to missing file type validation in the 'URAF_AJAX::method_upload' function. This affects all versions up to and including 1.6.20 and requires a "Profile Picture" field to be present on the form. Exploitation could lead to remote code execution on the affected server.