Key points
- CVE-2026-92798 affects the User Registration & Membership plugin for WordPress.
- The flaw allows unauthenticated arbitrary shortcode execution on restricted pages.
- Versions up to and including 5.2.8 are vulnerable; no patch is confirmed in the source.
The User Registration & Membership plugin for WordPress contains a high-severity vulnerability tracked as CVE-2026-92798. According to the National Vulnerability Database record, the flaw affects all versions up to and including 5.2.8. The issue stems from insufficient input sanitization in the plugin’s processing logic. Specifically, the HTTP_REFERER header is passed through a basic sanitization function that fails to strip WordPress shortcode delimiters. This allows unauthenticated attackers to inject arbitrary shortcodes into content restriction messages.
In plain English
The plugin uses a feature called "smart tags" to insert dynamic data into messages shown on restricted pages. One such tag, {{referrer_url}}, pulls the URL of the page the visitor came from. This data comes from the HTTP_REFERER header sent by the user’s browser. The plugin processes this header using sanitize_text_field(), which removes some dangerous characters but leaves WordPress shortcodes intact. When the processed header is inserted into a message, the system executes any shortcodes found within it.
The background
The vulnerability is classified under CWE-94, which relates to code injection flaws. The CVSS score is 8.1, placing it in the high severity range. The source material does not mention a confirmed fix or update available for this issue. This publication previously reported on a separate vulnerability in Wavlink router firmware on October 13, 2026, which allowed arbitrary OS command execution via a CGI script.
Who needs to act first
Teams should prioritize updating systems that expose restricted content to unauthenticated users. Identify sites using the User Registration & Membership plugin and check if they utilize the {{referrer_url}} smart tag. If no patch is available, consider disabling the smart tag feature or restricting access to affected pages. Test any configuration changes in a non-production environment first. Back up site configurations before making changes. Monitor logs for unusual shortcode execution attempts to detect potential exploitation early.
What to do and how to stay safe: WordPress
- Audit WordPress installations for the User Registration & Membership plugin versions up to 5.2.8.
- Disable the {{referrer_url}} smart tag if it is not essential for your site’s functionality.
- Monitor server logs for unexpected shortcode execution or unusual HTTP_REFERER header patterns.
- Once the vendor provides an update, apply it to all affected installations immediately.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-92798?
It is a high-severity vulnerability in the User Registration & Membership plugin for WordPress that allows arbitrary shortcode execution.
Which versions are affected?
All versions of the plugin up to and including 5.2.8 are vulnerable.
Is there a patch available?
No, the source material does not confirm that a fix or update has been released.
