CVE-2026-92798 wpeverest CVE debrief

Who should care

Defenders responsible for WordPress installations using the User Registration & Membership plugin, particularly those with restricted pages using the {{referrer_url}} smart tag, should assess exposure and prioritize verification and updates.

Why it matters

The vulnerability in the User Registration & Membership plugin for WordPress allows arbitrary shortcode execution, posing a risk to WordPress installations using the plugin, particularly those with restricted pages. Defenders should prioritize verification, updates, and monitoring.

• Potential execution of arbitrary registered shortcodes on restricted pages
• Possible unauthorized access to restricted content
• Need for verification of plugin version and exposure assessment
• Priority for updating to a secure plugin version

Technical summary

The User Registration & Membership plugin for WordPress is vulnerable to arbitrary shortcode execution due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(). The attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.

Defensive priority

Defenders should prioritize verifying and updating the User Registration & Membership plugin to a secure version, assessing exposure on restricted pages using the {{referrer_url}} smart tag, and monitoring for potential shortcode execution attempts.

Recommended defensive actions

• Verify and update the User Registration & Membership plugin to a secure version
• Assess exposure on restricted pages using the {{referrer_url}} smart tag
• Monitor for potential shortcode execution attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code. The vulnerability is caused by insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(). The attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). Defeners

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.