{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/user-registration--membership-plugin--5.2.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-92798"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["User Registration \u0026 Membership plugin (\u003c= 5.2.8)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","wordpress","arbitrary-code-execution"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe User Registration \u0026amp; Membership plugin for WordPress, in versions up to and including 5.2.8, contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. The flaw exists within the UR_Smart_Tags::process() method, which fails to adequately sanitize the HTTP_REFERER header before incorporating it into a Content Restriction message.\u003c/p\u003e\n\u003cp\u003eThe application utilizes sanitize_text_field(), which preserves shortcode delimiters such as brackets, and subsequently processes the input through WordPress core functions apply_shortcodes() or do_shortcode(). By crafting a specific HTTP_REFERER header, an attacker can inject malicious shortcodes into pages that utilize the {{referrer_url}} smart tag. When the target page is viewed by a user, the injected shortcode is rendered, potentially leading to unauthorized data access, information disclosure, or other administrative actions depending on the specific shortcodes available within the WordPress environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability carries a CVSS v3.1 score of 8.1, indicating a high impact on the confidentiality and integrity of WordPress sites utilizing this plugin. Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes, which may result in unauthorized data retrieval or elevated privileges if specific, sensitive shortcodes are present in the environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the User Registration \u0026amp; Membership plugin to a version patched against CVE-2026-92798 (version 5.2.9 or later).\u003c/li\u003e\n\u003cli\u003eReview all pages configured with \u0026quot;Content Restriction\u0026quot; messages to identify if the {{referrer_url}} tag is actively used.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) rule to inspect and block HTTP_REFERER headers containing bracketed shortcode syntax (e.g., matching the regex pattern \u0026quot;\\[.*\\]\u0026quot;).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T04:48:35Z","date_published":"2026-10-17T04:48:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-92798/","summary":"The User Registration \u0026 Membership plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution due to insufficient sanitization of the HTTP_REFERER header.","title":"Arbitrary Shortcode Execution in User Registration \u0026 Membership Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-92798/"}],"language":"en","title":"CraftedSignal Threat Feed - User Registration \u0026 Membership Plugin (\u003c= 5.2.8)","version":"https://jsonfeed.org/version/1.1"}