CVE-2026-92798
Received Received - Intake

Arbitrary Shortcode Execution in User Registration & Membership WordPress Plugin

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: Wordfence

Description
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-92798
EUVD
EUVD-2026-103233

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows unauthenticated attackers to execute arbitrary WordPress shortcodes on restricted pages by manipulating the HTTP_REFERER header. The plugin fails to properly sanitize the referrer URL before inserting it into a message that gets processed as a shortcode.

Detection Guidance

Check WordPress sites running the User Registration & Membership plugin versions up to 5.2.8. Inspect server logs for requests containing the {{referrer_url}} smart tag in restricted page messages. Look for unusual shortcode execution patterns in access logs.

Impact Analysis

An attacker could exploit this to run malicious shortcodes, potentially stealing data, defacing your site, or gaining unauthorized access. It affects any restricted page using the {{referrer_url}} smart tag in the User Registration & Membership plugin versions up to 5.2.8.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. A breach may result in legal penalties, fines, or reputational damage due to compromised user data.

Mitigation Strategies

Update the User Registration & Membership plugin to the latest version immediately. If an update is unavailable, disable the plugin temporarily. Review and sanitize all user-controlled inputs in restricted page messages. Monitor for unauthorized shortcode execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92798. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart