CVE-2026-15222
Deferred Deferred - Pending Action

Arbitrary Shortcode Execution in User Registration & Membership Plugin for WordPress

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-15222
EUVD
EUVD-2026-102801

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects a WordPress plugin called User Registration & Membership. It allows authenticated users with subscriber-level access or higher to execute arbitrary shortcodes without proper validation. The issue arises because the plugin runs a function called do_shortcode without checking user input first.

Detection Guidance

To detect this vulnerability, check WordPress sites running the User Registration & Membership plugin versions up to 5.2.8. Look for unauthorized shortcode execution attempts in logs or database entries. Review subscriber-level user actions for suspicious shortcode usage.

Impact Analysis

An attacker could exploit this to run malicious shortcodes on your WordPress site. This might allow them to perform actions like creating unauthorized user accounts, accessing restricted content, or embedding harmful scripts. The impact depends on the site's configuration and plugins used.

Compliance Impact

This vulnerability allows authenticated attackers with subscriber-level access to execute arbitrary shortcodes, which could lead to unauthorized data access, modification, or disclosure. This may violate compliance requirements under GDPR (data protection) and HIPAA (protected health information) by enabling unauthorized processing or exposure of sensitive user data.

Mitigation Strategies

Update the User Registration & Membership plugin for WordPress to the latest version beyond 5.2.8. If immediate update is not possible, consider disabling the plugin temporarily or restricting subscriber-level access to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15222. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart