CVE-2026-92798: WordPress User Registration Plugin RCE Flaw

CVE-2026-92798 Overview

CVE-2026-92798 is an arbitrary shortcode execution vulnerability affecting the User Registration & Membership plugin for WordPress through version 5.2.8. The flaw resides in the referrer_url branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is passed only through sanitize_text_field(). This function does not strip WordPress shortcode delimiters before the value is substituted into a Content Restriction message and executed via apply_shortcodes()/do_shortcode(). Authenticated attackers with low privileges can execute any registered shortcode on restricted pages that use the {{referrer_url}} smart tag.

Critical Impact

Attackers can invoke any registered WordPress shortcode in the context of a restricted page, potentially exposing sensitive data, altering site behavior, or chaining with other shortcode-based primitives.

Affected Products

• WordPress User Registration & Membership plugin versions up to and including 5.2.8
• Sites using the Content Restriction module with the {{referrer_url}} smart tag
• WordPress installations exposing restricted pages to authenticated low-privilege users

Discovery Timeline

• 2026-10-17 - CVE-2026-92798 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-92798

Vulnerability Analysis

The vulnerability is classified under CWE-94: Improper Control of Generation of Code. The plugin processes smart tags inside Content Restriction messages shown to users without the required membership level. When a message uses {{referrer_url}}, the plugin substitutes the referrer value and then runs the resulting string through the WordPress shortcode parser.

Because the referrer originates from an HTTP request header, an attacker fully controls its contents. The sanitizer applied, sanitize_text_field(), removes line breaks and tags but preserves the [ and ] characters that WordPress uses as shortcode delimiters. The attacker can therefore inject shortcode markup that the Content Restriction renderer later evaluates.

Root Cause

The root cause is insufficient input sanitization in the referrer_url handler of UR_Smart_Tags::process(). The code trusts sanitize_text_field() to make header input safe before concatenating it into content that will be executed by do_shortcode(). No shortcode-specific escaping, allowlist, or stripping of bracket characters is applied prior to execution. See the vulnerable smart tag handler and the content restriction rendering path.

Attack Vector

Exploitation requires an authenticated low-privilege account and a target page that is subject to Content Restriction with a message containing {{referrer_url}}. The attacker issues a request to the restricted page with a crafted Referer header containing shortcode syntax. The plugin substitutes the header value into the restriction message, then apply_shortcodes() executes the attacker-chosen shortcode server-side. Any shortcode registered by WordPress core, the plugin ecosystem, or custom theme code becomes callable, including shortcodes that expose private data or trigger administrative actions.

Detection Methods for CVE-2026-92798

Indicators of Compromise

• HTTP requests to restricted pages carrying Referer headers that contain [ and ] characters or recognizable shortcode names
• Web server access logs showing unusual referrer values on URLs protected by the User Registration Content Restriction module
• Unexpected output on restriction pages (data normally gated by shortcode, administrative content, or form submissions)
• WordPress audit logs recording shortcode execution tied to anonymous or low-privilege sessions

Detection Strategies

• Inspect reverse-proxy and web server logs for Referer headers containing shortcode delimiters such as [shortcode_name on routes handled by User Registration
• Monitor for successful HTTP 200 responses on Content Restriction pages that return larger-than-expected payloads
• Correlate authenticated session identifiers with repeated requests to the same restricted URL carrying variable Referer headers

Monitoring Recommendations

• Enable verbose request logging on pages governed by the Content Restriction module until the plugin is upgraded
• Alert on Referer header values exceeding typical length or containing [, ], or {{ sequences
• Review WordPress plugin update history to confirm which sites still run User Registration 5.2.8 or earlier

How to Mitigate CVE-2026-92798

Immediate Actions Required

• Upgrade the User Registration & Membership plugin to a version later than 5.2.8 that includes changeset 3741339
• Audit all Content Restriction messages and remove the {{referrer_url}} smart tag where it is not strictly required
• Review which shortcodes are registered on affected sites and disable any that expose sensitive data or privileged actions

Patch Information

The maintainers addressed the issue in changeset 3741339 to includes/class-ur-smart-tags.php. Additional analysis is available in the Wordfence advisory for CVE-2026-92798.

Workarounds

• Remove {{referrer_url}} from all Content Restriction messages until the patched plugin version is deployed
• Add a web application firewall rule that strips or blocks Referer headers containing [ or ] characters for requests to WordPress sites running User Registration
• Restrict the ability to edit Content Restriction messages to trusted administrators and review existing templates for the vulnerable smart tag

# Example WAF rule concept: block requests whose Referer header contains shortcode delimiters
# (adapt to your WAF syntax; shown here as pseudo-ModSecurity)
SecRule REQUEST_HEADERS:Referer "@rx \[[a-z0-9_\-]+" \
    "id:1092798,phase:1,deny,status:403,msg:'Potential CVE-2026-92798 shortcode injection in Referer'"