Arbitrary Shortcode Execution in User Registration & Membership Plugin

The User Registration & Membership plugin for WordPress, in versions up to and including 5.2.8, contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. The flaw exists within the UR_Smart_Tags::process() method, which fails to adequately sanitize the HTTP_REFERER header before incorporating it into a Content Restriction message.

The application utilizes sanitize_text_field(), which preserves shortcode delimiters such as brackets, and subsequently processes the input through WordPress core functions apply_shortcodes() or do_shortcode(). By crafting a specific HTTP_REFERER header, an attacker can inject malicious shortcodes into pages that utilize the {{referrer_url}} smart tag. When the target page is viewed by a user, the injected shortcode is rendered, potentially leading to unauthorized data access, information disclosure, or other administrative actions depending on the specific shortcodes available within the WordPress environment.

Impact

The vulnerability carries a CVSS v3.1 score of 8.1, indicating a high impact on the confidentiality and integrity of WordPress sites utilizing this plugin. Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes, which may result in unauthorized data retrieval or elevated privileges if specific, sensitive shortcodes are present in the environment.

Recommendation

• Upgrade the User Registration & Membership plugin to a version patched against CVE-2026-92798 (version 5.2.9 or later).
• Review all pages configured with "Content Restriction" messages to identify if the {{referrer_url}} tag is actively used.
• Implement a Web Application Firewall (WAF) rule to inspect and block HTTP_REFERER headers containing bracketed shortcode syntax (e.g., matching the regex pattern "\[.*\]").