The User Registration Advanced Fields plugin for WordPress contains an arbitrary file upload vulnerability due to missing file type validation in the URAF_AJAX::method_upload function. This affects all versions up to and including 1.6.20. Unauthenticated attackers can exploit this vulnerability to upload arbitrary files to the server, potentially leading to remote code execution. The vulnerability can only be exploited when a Profile Picture field is added to the registration form. This represents a significant security risk for WordPress sites using the affected plugin versions.