CVE-2026-15222 in User Registration & Membership Plugin
Summary
by MITRE • 10/16/2026
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in the User Registration & Membership plugin for WordPress, affecting versions up to 5.2.8, represents a significant security risk rooted in improper input validation during shortcode processing. This flaw allows authenticated attackers with subscriber-level access or higher to execute arbitrary shortcodes within the context of the application. The core technical issue lies in the software's failure to properly validate user-supplied values before passing them into the do_shortcode function. In WordPress, shortcodes are powerful tools that allow developers and users to embed dynamic content using simple tags. However, when these shortcodes can be executed based on unvalidated input from authenticated but low-privilege users, it creates a pathway for unauthorized actions or data manipulation.
From a technical perspective, the vulnerability stems from a lack of rigorous sanitization and validation checks before invoking do_shortcode. This function is designed to parse and execute shortcode tags found in post content, widgets, or other text areas. When an attacker can influence the input that gets passed into this function without adequate verification, they effectively gain the ability to run code associated with any registered shortcode on the site. Since many plugins register shortcodes for specific functionalities such as payment processing, user profile management, or content restriction bypassing, exploiting this flaw could lead to severe consequences depending on which shortcodes are available and how they handle input internally.
The operational impact of this vulnerability is substantial because it leverages authenticated access rather than requiring anonymous exploitation. While the attacker must have at least subscriber-level privileges, such accounts can often be created easily or obtained through credential stuffing attacks if weak passwords are in use. Once inside, an attacker with these minimal permissions could potentially manipulate user profiles, interfere with subscription processes, restrict or expose content improperly, or even escalate their own privileges by exploiting side effects of certain shortcodes. This undermines the principle of least privilege and compromises the integrity of membership-based websites that rely on controlled access to premium features.
This type of vulnerability aligns closely with CWE-94 Improper Control of Generation of Code (Code Injection), specifically where user input influences code execution without proper validation. It also relates to CWE-798 Use of Hard-coded Credentials if the exploitation involves leveraging default or weak account credentials, and potentially CWE-269 Improvement of Privilege if the executed shortcodes allow for privilege escalation. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1053 Scheduled Task/Job which might be relevant if certain shortcodes trigger background processes, but more directly it falls under T1190 Exploit Public-Facing Application where an attacker exploits a flaw in internet-facing software components like WordPress plugins.
Mitigation strategies should focus on immediate patching and enhanced input validation practices. Site administrators must update the User Registration & Membership plugin to version 5.2.9 or later, which addresses this specific issue by implementing stricter validation before shortcode execution. For environments where updating is not immediately feasible, temporary mitigations include restricting user registration capabilities if they are not essential, enforcing strong password policies for all accounts including subscribers, and monitoring logs for unusual activity related to shortcode usage. Additionally, developers should adopt secure coding standards that emphasize validating and sanitizing all inputs prior to processing them through sensitive functions like do_shortcode. Implementing Web Application Firewalls with rules targeting suspicious shortcode patterns can also provide an additional layer of defense against exploitation attempts.