---
id: "CVE-2026-15222"
kind: "vulnerability"
aliases: ["CVE-2026-15222"]
title: "WordPress membership plugin lets subscribers run arbitrary shortcodes"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["auth-required", "plugin-not-installed"]
published_at: "2026-10-16T07:17:12+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:18:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15222", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# WordPress membership plugin lets subscribers run arbitrary shortcodes

The User Registration & Membership plugin for WordPress passes an unvalidated value to do_shortcode, so any logged-in user can trigger shortcodes they should not reach. An attacker with a subscriber account can execute arbitrary shortcodes on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get user-registration --field=version` if WP-CLI is available
- Confirm whether the site allows subscriber self-registration, since that is the account level needed

## Fix

- Update the User Registration & Membership plugin to a release later than `5.2.8`, as the sources say all versions up to and including `5.2.8` are affected
- If no fixed release is available, disable the plugin or restrict user registration until it is patched

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-15222

## From the sources

The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_