CVE-2026-92798: User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrerurl' branch of URSmartTags::process(), where the attacker-controlled HTTPREFERER header is only passed through sanitizetextfield() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via applyshortcodes()/doshortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrerurl}} smart tag.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites running User Registration & Membership version 5.2.8 or earlier are exposed if they have a restricted page whose Content Restriction message includes the supported {{referrer_url}} smart tag. The issue can be reached remotely because the Referer header is attacker-controlled.
Does an attacker need an account or user interaction?
No. Although the classification text labels the issue as authenticated, the description states that unauthenticated attackers can exploit it. An attacker only needs to send a request with a Referer header containing shortcode syntax to an affected restricted page.
What makes the injected shortcode execute?
The plugin inserts the Referer header value into the restriction message after sanitize_text_field(), which does not remove WordPress shortcode delimiters. The resulting message is then processed through apply_shortcodes()/do_shortcode(), allowing registered shortcodes in the header value to run.