User Registration & Membership WordPress plugin: Arbitrary shortcode execution via Referer
Summary
The User Registration & Membership plugin for WordPress up to and including version 5.2.8 does not sufficiently sanitize the HTTP Referer header when it is used in the {{referrer_url}} smart tag of content restriction messages. An attacker can inject WordPress shortcodes that are executed on restricted pages, which can allow arbitrary registered shortcodes to run. The CNA rates the impact as high for confidentiality and integrity (CVSS 8.1). The sources disagree on whether an unauthenticated attacker can exploit this or whether a low-privilege account is required.
Affected
- User Registration & Membership plugin for WordPress, versions up to and including 5.2.8
- Default configuration: unaffected (per CNA record)
- Exploitable only on restricted pages whose content restriction message uses {{referrer_url}}
Fixed in
Unknown. VulDB recommends updating to version 5.2.9 or later, but this could not be verified against a vendor source. A WordPress trunk changeset (3741339) touches the vulnerable file.
Workaround
- No vendor workaround found.
- Review content restriction messages and remove {{referrer_url}} where it is not needed.
- Disable third-party shortcodes that are not needed.
- Disable open user registration if it is not required.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV at the time of research.
- No public proof of concept or exploitation report found; this does not prove that none exists.
- EPSS score: unknown.
Our recommendation
- Verify the installed plugin version now and update to the latest release, confirming it includes the fix from changeset 3741339.
- Until patched, remove {{referrer_url}} from content restriction messages where not needed.
- If open registration is not needed, disable it.
- Monitor for exploitation and check CISA KEV.
- Priority: high for sites with open registration; medium for sites with closed registration and no untrusted accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence advisory www.wordfence.com
- Vulnerable source: class-ur-smart-tags.php (5.2.8) plugins.trac.wordpress.org
- Trunk changeset 3741339 plugins.trac.wordpress.org
- VulDB CVE-2026-92798 vuldb.com
- Vulners CVE record vulners.com
- WordPress.org plugin page wordpress.org
- Positive Technologies PT-2026-116363 vulners.com
- EPSS/KEV tracker entry (third party) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:50.
Original description (NVD)
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.
NVD references (6)
- https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L474
- https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L475
- https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/class-urc…
- https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/functions…
- https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/class-ur-smart-tags.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ec317df9-c7ef-49a3-9818-903dfe4bdd03?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.