{"id":"CVE-2026-92798","kind":"vulnerability","aliases":["CVE-2026-92798"],"related":[],"title":"WordPress User Registration plugin: unauthenticated shortcode execution via referer header","description":"The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.","summary":"The User Registration & Membership WordPress plugin up to and including 5.2.8 passes the HTTP Referer header into a restricted-content message without stripping shortcode delimiters, then runs that message through shortcode processing. An unauthenticated visitor can make any registered WordPress shortcode execute on a restricted page that uses the {{referrer_url}} smart tag.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","user-registration-plugin","wordpress"],"not_affected_if":["default-config","plugin-updated"],"how_to_check":"- Check the installed version of the User Registration & Membership plugin (`wp plugin get user-registration --field=version` or the Plugins screen) and see whether it is `5.2.8` or lower.\n- Search Content Restriction messages for the `{{referrer_url}}` smart tag.","fix":"- Update the User Registration & Membership plugin to a version above `5.2.8`; the fixed version number is unknown from the sources.\n- Until updated, remove `{{referrer_url}}` from restricted-content messages.","status":"open","published_at":"2026-10-17T04:17:10+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:06:39+00:00","updated_at":"2026-10-25T03:06:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:06:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update the User Registration & Membership plugin to a version above `5.2.8`; the fixed version number is unknown from the sources.\n- Until updated, remove `{{referrer_url}}` from restricted-content messages.","reach":"internet","title":"WordPress User Registration plugin: unauthenticated shortcode execution via referer header","impact":"high","summary":"The User Registration & Membership WordPress plugin up to and including 5.2.8 passes the HTTP Referer header into a restricted-content message without stripping shortcode delimiters, then runs that message through shortcode processing. An unauthenticated visitor can make any registered WordPress shortcode execute on a restricted page that uses the {{referrer_url}} smart tag.","category":"package","nicknames":[],"who_cares":["wordpress","user-registration-plugin","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Arbitrary registered WordPress shortcodes execute on restricted pages for any visitor","analyst_note":"Check the plugin's changelog or the WordPress.org plugin page for the first fixed version above 5.2.8; the sources do not give it.","how_to_check":"- Check the installed version of the User Registration & Membership plugin (`wp plugin get user-registration --field=version` or the Plugins screen) and see whether it is `5.2.8` or lower.\n- Search Content Restriction messages for the `{{referrer_url}}` smart tag.","needs_analyst":true,"not_affected_if":["default-config","plugin-updated"],"who_is_affected":"Sites running the User Registration & Membership plugin at version 5.2.8 or lower that use Content Restriction messages containing the {{referrer_url}} smart tag are exposed, since the attacker-controlled referer reaches shortcode execution only through that tag. Sites without the plugin, on a newer version, or without that tag in their restriction messages are unlikely to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000696,"input_tokens":3467,"output_tokens":698,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-92798':13A,16A '/do_shortcode':154C '5.2.8':36B,99C 'appli':152C 'arbitrari':90C,164C 'attack':120C,161C 'attacker-control':119C 'branch':111C 'content':46B,144C 'control':121C 'cve':11A,14A 'delimit':51B,138C 'due':102C 'execut':7A,68B,92C,150C,163C 'field':131C 'header':10A,41B,124C 'host':20B 'http':39B,122C 'includ':35B,98C 'input':105C 'insuffici':104C 'make':63B,156C 'membership':29B,83C 'messag':47B,55B,146C,172C 'packag':17B 'page':72B,170C 'pass':37B,127C 'plugin':4A,24B,31B,84C 'possibl':158C 'process':58B,116C 'refer':9A,40B,123C 'referr':76B,109C,176C 'regist':65B,165C 'registr':3A,23B,28B,82C 'restrict':45B,71B,145C,169C 'restricted-cont':44B 'run':53B 'sanit':106C,129C 'self':19B 'self-host':18B 'shortcod':6A,50B,57B,67B,91C,137C,153C,166C 'smart':78B,114C,178C 'strip':49B,135C 'subsequ':149C 'substitut':141C 'support':175C 'tag':79B,115C,179C 'text':130C 'unauthent':5A,60B,160C 'ur':113C 'url':77B,110C,177C 'use':74B,173C 'user':2A,22B,27B,81C 'user-registration-plugin':21B 'version':94C 'via':8A,151C 'visitor':61B 'vulner':88C 'whose':171C 'without':48B 'wordpress':1A,25B,30B,66B,86C,136C","nicknames":[],"mitigations":[],"who_affected":"Sites running the User Registration & Membership plugin at version 5.2.8 or lower that use Content Restriction messages containing the {{referrer_url}} smart tag are exposed, since the attacker-controlled referer reaches shortcode execution only through that tag. Sites without the plugin, on a newer version, or without that tag in their restriction messages are unlikely to be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T04:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92798","severity":null,"published_at":"2026-10-17T04:17:10+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}