{"id":"CVE-2026-92798","title":"User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag","summary":"The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-94"],"vendor":"wpeverest","product":"User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","affected":["user_registration_membership_free_paid_memberships_subscriptions_content_restriction_user_profile_custom_user_registration_login_builder <= 5.2.8"],"published":"2026-10-17","updated":"2026-10-17","sourceUpdated":"2026-10-17T03:43:31.068Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92798","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec317df9-c7ef-49a3-9818-903dfe4bdd03?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L475"},{"url":"https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L474"},{"url":"https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/class-urcr-frontend.php#L1383"},{"url":"https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/functions-urcr-core.php#L693"},{"url":"https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/class-ur-smart-tags.php"}],"tags":["cve.org"],"ingestedAt":"2026-10-17T03:58:44.706Z","slug":"CVE-2026-92798","body":"## Overview\n\nThe User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.\n\n## Affected\n\n- `user_registration_membership_free_paid_memberships_subscriptions_content_restriction_user_profile_custom_user_registration_login_builder <= 5.2.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}