User Registration & Membership CVE-2026-92798

Exploitation requires the site to run the User Registration & Membership plugin (versions up to 5.2.8) with the Content Restriction module enabled AND a restricted page whose restriction message is configured to use the {{referrer_url}} smart tag - this specific, non-default configuration is what reaches the vulnerable referrer_url branch of UR_Smart_Tags::process(). The attacker then only needs to supply a crafted HTTP Referer header containing shortcode delimiters; per the description no authentication or user interaction is required. Limiting factors: impact is bounded to shortcodes actually registered/active on the target site, and any site not using the {{referrer_url}} smart tag within a restriction message is not exploitable regardless of plugin version.

Signals are mixed and one is internally inconsistent. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H, 8.1 HIGH) describes a network-reachable, low-complexity flaw, but the description explicitly states 'unauthenticated attackers' and the attack vector is the attacker-controlled HTTP_REFERER header - which requires no login. This is a direct conflict: the Wordfence/NVD vector carries PR:L while the technical description implies PR:N - verify with vendor. Treating it as unauthenticated (consistent with the description) raises real-world severity toward critical. There is no EPSS score, no CISA KEV listing, and no public exploit referenced, so exploitation status is: no public exploit identified at time of analysis. Crucially, exploitation is gated by a non-default configuration - the targeted restricted page's Content Restriction message must embed the {{referrer_url}} smart tag - so the blast radius is limited to sites using that specific feature, and actual impact depends on which shortcodes are registered on the site. This is a genuine priority for WordPress sites running this plugin's content-restriction module with the referrer smart tag, but the config dependency makes exploitation targeted rather than universal, tempering the raw CVSS number.

An unauthenticated attacker sends an HTTP request to a content-restricted page whose restriction message uses the {{referrer_url}} smart tag, setting the Referer header to a value containing WordPress shortcode delimiters (e.g. a registered shortcode). Because the referrer is only passed through sanitize_text_field() - which does not strip shortcode brackets - before being run through apply_shortcodes()/do_shortcode(), the attacker's shortcode is executed server-side. No public proof-of-concept is referenced in the provided data.