Live › vulnerability › CVE-2026-15222
Go to dashboardThe User Registration & Membership plugin for WordPress passes an unvalidated value to do_shortcode, so any logged-in user can trigger shortcodes they should not reach. An attacker with a subscriber account can execute arbitrary shortcodes on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the User Registration & Membership plugin at version or earlier. Exposure depends on whether users can obtain a subscriber-level account, which open registration allows. Sites without this plugin, or running a later version, can skip it.
5.2.8No product ranges from the sources yet.
wp plugin get user-registration --field=version if WP-CLI is available5.2.8, as the sources say all versions up to and including 5.2.8 are affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
This page as .md · .json · in your agent: get_signal("CVE-2026-15222")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.