CVE-2026-4882 - WordPress User Registration Advanced Fields upload RCE

wp plugin list --fields=name,version,status | grep -Ei 'user-registration-advanced-fields|advanced-fields'
wp plugin status user-registration-advanced-fields
rg -n "user-registration-advanced-fields|URAF_AJAX|method_upload|profile picture|profile_picture|profile-pic|profile_pic" .
find . -path "*/wp-content/plugins/*advanced*fields*" -maxdepth 8 -type f | head
find . -path "*/wp-content/uploads/*" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) | head

Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2026-4882 (WordPress User Registration Advanced Fields
arbitrary file upload). Produce exactly one output:

- A reviewer-ready PR/change request that removes or contains the vulnerable
  upload path, deploys a fixed vendor release if one is available, adds
  verification, and documents required operator cleanup, or
- TRIAGE.md if this repository does not own the WordPress plugin deployment or
  cannot make a safe patch.

## Rules

- Scope only CVE-2026-4882.
- Do not upload executable payloads to production or shared staging systems.
- Do not print, commit, or attach real uploaded user files, profile pictures,
  cookies, sessions, WordPress nonces, or user data.
- Do not hand-edit vendored plugin code unless no vendor upgrade is available
  and the patch is explicitly documented as temporary containment.
- Do not leave a public Profile Picture upload field enabled on a vulnerable
  add-on version.
- Do not auto-merge.

## Steps

1. Inventory WordPress ownership in this repository:
   - `wp-content/plugins/user-registration-advanced-fields`;
   - Composer, Bedrock, premium-plugin, or artifact references for User
     Registration Advanced Fields;
   - WP-CLI install scripts, Dockerfiles, build artifacts, Helm charts,
     Terraform, Ansible, or deployment runbooks;
   - SBOMs, image manifests, plugin lock/state files, and WordPress operator
     documentation.
2. If the repository does not deploy or package a WordPress site with User
   Registration Advanced Fields, stop with `TRIAGE.md` explaining what was
   checked and who owns the runtime remediation.
3. Determine the resolved User Registration Advanced Fields version for every
   deployable target. A target is vulnerable if it resolves to `<=1.6.20`.
4. Determine whether any public registration, account, profile, membership, or
   onboarding form includes the add-on's Profile Picture upload field.
5. Check whether this repository can consume a vendor release fixed after
   `1.6.20`. If yes, upgrade through the normal channel and regenerate
   Composer locks, plugin manifests, image metadata, SBOMs, or deployment
   render output as appropriate.
6. If no fixed release is available or the fixed release cannot be consumed
   immediately, implement the safest containment controlled by this repo:
   disable the add-on, remove/deactivate the Profile Picture field from public
   forms, block the affected upload handler at the edge, or add an emergency
   runbook requiring operators to disable the feature before deployment.
7. Ensure web server or platform configuration prevents PHP execution in
   WordPress upload directories. Add or update Apache, Nginx, Caddy,
   container, or hosting config where this repository owns it.
8. Add verification using a non-executable benign test file in a non-production
   environment that proves the vulnerable upload path is disabled, patched, or
   rejects dangerous file types. Do not include exploit payloads.
9. Add a PR body section named `CVE-2026-4882 operator actions` that requires:
   - confirmation production no longer runs a vulnerable public Profile
     Picture upload path;
   - confirmation of the deployed add-on version or disablement status;
   - review of `wp-content/uploads` and any custom upload directory for
     executable or suspicious files;
   - review of web logs for the add-on upload handler and unexpected upload
     requests;
   - removal or quarantine of suspicious uploads through an operator-approved
     incident process, not an automatic destructive script.
10. Run the relevant validation: Composer install/update checks, WordPress
    plugin inventory, image build, deployment rendering, web server config
    tests, PHP tests, upload smoke tests, and security scans available in this
    repository.
11. Use PR title:
    `fix(sec): remediate CVE-2026-4882 in User Registration Advanced Fields`.

## Stop conditions

- No WordPress site or User Registration Advanced Fields deployment is
  controlled by this repository.
- The plugin version or form configuration is managed exclusively in production
  outside the repo.
- No fixed vendor release is available and this repo cannot disable the add-on,
  remove the Profile Picture field, or block the upload route.
- The only apparent fix would automatically delete user uploads or expose
  private user files.
- Validation fails for unrelated pre-existing reasons; document the failure
  instead of broadening scope.