User Registration & Membership CVE-2026-15222

Exploitation requires an authenticated account with subscriber-level privileges or above on a site running the User Registration & Membership plugin (WPEverest) at version 5.2.8 or earlier. The practical prerequisite is that the site permits user registration - the plugin's primary use case - so an attacker can self-provision the needed subscriber account; on sites that disable open registration this becomes a meaningful limiting factor. The specific trigger is an action that passes an unvalidated value into do_shortcode (handled in the smart-tags component, class-ur-smart-tags.php). Limiting factors: authentication is mandatory (not unauthenticated), impact is scoped to shortcode execution with only low confidentiality/integrity effect, and no user interaction by a victim is required.

This is a moderate-severity, authentication-gated issue rather than a drop-everything priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) indicates network-reachable, low-complexity exploitation but requires authentication at subscriber level or above (PR:L), and the description confirms this ('authenticated attackers, with subscriber-level access and above'). Impact is bounded to low confidentiality and low integrity with no availability impact, which is consistent with arbitrary shortcode execution (abuse of do_shortcode) rather than unauthenticated full remote code execution. No EPSS score, no CISA KEV listing, and no public exploit were supplied, so there is no evidence of active or at-scale exploitation at this time - the risk is driven by the fact that subscriber accounts are trivially obtained on sites with open registration (which is precisely the purpose of this membership/registration plugin), lowering the practical barrier of the PR:L requirement. Signals are internally consistent; the main tension is the 'RCE' tag versus the actual CVSS impact (C:L/I:L, not C:H/I:H), so treat this as scoped shortcode injection, not classic RCE, unless the vendor confirms a shortcode path to code execution.

An attacker registers a free subscriber-level account on a WordPress site running this plugin (open self-registration is the plugin's core function), then invokes the affected action that passes an attacker-controlled value to do_shortcode without proper validation. By supplying crafted shortcode input, the attacker causes the site to execute arbitrary shortcodes in a context they should not control, potentially disclosing restricted content or triggering unintended plugin/theme actions. No public exploit code was identified at time of analysis.