---
id: CVE-2026-92798
title: >-
  User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+)
  Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
summary: >-
  The User Registration & Membership plugin for WordPress is vulnerable to
  Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is
  due to insufficient input sanitization in the 'referrer_url' branch of
  UR_Smart_Tags::…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-94
vendor: wpeverest
product: >-
  User Registration & Membership – Free & Paid Memberships, Subscriptions,
  Content Restriction, User Profile, Custom User Registration & Login Builder
affected:
  - >-
    user_registration_membership_free_paid_memberships_subscriptions_content_restriction_user_profile_custom_user_registration_login_builder
    <= 5.2.8
published: '2026-10-17'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T03:43:31.068Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-92798'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/ec317df9-c7ef-49a3-9818-903dfe4bdd03?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L475
  - url: >-
      https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L474
  - url: >-
      https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/class-urcr-frontend.php#L1383
  - url: >-
      https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/functions-urcr-core.php#L693
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/class-ur-smart-tags.php
tags:
  - cve.org
ingestedAt: '2026-10-17T03:58:44.706Z'
epss: 0.00369
epssPercentile: 0.2924
---

## Overview

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.

## Affected

- `user_registration_membership_free_paid_memberships_subscriptions_content_restriction_user_profile_custom_user_registration_login_builder <= 5.2.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.