CVE-2026-92798

8.1High

Published 17 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-94

Impact

Unauthenticated remote attackers can execute arbitrary registered WordPress shortcodes by spoofing the HTTP Referer header. This affects any restricted page configured to use the {{referrer_url}} smart tag in its access-restriction message.

Root cause

The plugin passes the attacker-controlled HTTP Referer header through sanitize_text_field(), which fails to strip shortcode syntax before running do_shortcode() on restriction messages.

Affected systems

User Registration & Membership plugin for WordPress up to and including version 5.2.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade the User Registration plugin to a version newer than 5.2.8. As an interim mitigation, edit Content Restriction settings to remove the {{referrer_url}} smart tag from all restriction messages.

shell

$ wp plugin update user-registration

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-92798