CVE-2026-92798 in User Registration & Membership Plugin
Summary
by MITRE • 10/17/2026
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The User Registration & Membership plugin for WordPress, specifically in versions up through 5.2.8, contains a critical security flaw that allows for Arbitrary Shortcode Execution by unauthenticated attackers. This vulnerability stems from insufficient input sanitization within the UR_Smart_Tags::process() method, particularly concerning the handling of the referrer_url smart tag. The plugin is designed to allow site administrators to customize content restriction messages using dynamic variables known as smart tags. One such variable is {{referrer_url}}, which is intended to display the URL from which a user was referred before encountering restricted content. However, the implementation fails to adequately secure this input against malicious manipulation, creating an avenue for code injection attacks that can compromise the integrity of the WordPress environment and potentially lead to remote code execution or cross-site scripting incidents depending on the shortcodes available in the specific installation.
The technical root cause lies in how the HTTP_REFERER header is processed before being inserted into the content restriction message template. When a user attempts to access restricted content, the plugin captures the referrer URL from the incoming request headers. Instead of applying robust sanitization that strips dangerous characters or validates expected formats, the code passes this attacker-controlled input solely through sanitize_text_field(). While this function removes certain HTML tags and special characters, it does not remove WordPress shortcode delimiters such as square brackets [ ]. Consequently, if an attacker crafts a malicious HTTP_REFERER header containing valid shortcodes enclosed in these delimiters, the plugin will accept them as literal text. This sanitized but still dangerous input is then substituted into the content restriction message string via the process() method.
Once the malicious payload has been injected into the message template, it becomes part of the output that WordPress renders to the user's browser. The vulnerability manifests when this modified message is subsequently processed by apply_shortcodes() or do_shortcode(). These functions are responsible for parsing and executing any shortcodes found within a string. Because the attacker-controlled data was not stripped of shortcode syntax during sanitization, these core WordPress functions interpret the injected content as executable code rather than plain text. This results in the arbitrary execution of registered shortcodes on any restricted page that utilizes the {{referrer_url}} smart tag in its restriction message configuration. The impact is severe because it requires no authentication; an unauthenticated user can trigger this behavior simply by visiting a URL with a crafted referrer header, such as one set via JavaScript or a malicious link from another site.
From a classification perspective, this vulnerability aligns closely with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS), although the specific mechanism involves shortcode execution rather than direct script injection. It also relates to CWE-20: Improper Input Validation, as the application fails to validate or sanitize user-supplied input before using it in a command or function call. In terms of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to T1190: Exploit Public-Facing Application and potentially T1059: Command and Scripting Interpreter if the executed shortcodes allow for further system interaction. The lack of proper output encoding and input validation allows an external actor to inject commands that are then interpreted by a trusted application component, bypassing standard access controls due to the unauthenticated nature of the exploit vector.
The operational impact of this vulnerability is significant for any WordPress site using affected versions with content restriction features enabled. Attackers can leverage arbitrary shortcode execution to perform various malicious actions depending on which plugins and shortcodes are active on the target system. For instance, if a plugin provides a shortcode that exposes sensitive data or performs administrative functions without proper capability checks, an attacker could exploit this to leak information or escalate privileges indirectly. Furthermore, since many shortcodes can output HTML content, attackers may use this vector for stored or reflected cross-site scripting attacks against visitors of the restricted pages. This undermines user trust and compromises site security by allowing unauthenticated users to execute code within the context of a trusted domain.
To mitigate this vulnerability, immediate action is required from system administrators and developers. The primary remediation step is to update the User Registration & Membership plugin to version 5.2.9 or later, where the issue has been addressed with proper input sanitization that strips shortcode delimiters before processing. For sites unable to upgrade immediately due to compatibility concerns, a temporary workaround involves manually editing the plugin code if feasible, though this is not recommended for production environments without thorough testing. Administrators should also audit their content restriction messages to ensure they do not rely on smart tags derived from untrusted HTTP headers unless those inputs are rigorously sanitized using functions like wp_kses() or custom logic that explicitly removes square brackets and other shortcode syntax characters. Regular security audits and keeping all WordPress plugins up to date remain essential practices for maintaining a secure web infrastructure against such injection-based threats.