User Registration & Membership EUVD-2026-27241

Exploitation requires the attacker to be an authenticated WordPress user with at least Contributor-level access (or higher: Author, Editor, Administrator). The target WordPress site must have the User Registration & Membership plugin version 5.1.4 or earlier installed and active. The attacker must know or enumerate a valid page or post ID belonging to another user or the site administrator to target. Default WordPress configurations where contributors can create posts satisfy this condition; no special plugin configuration is required beyond installation. Exploitation is blocked if the site enforces stricter user role policies (e.g., contributors cannot create posts, only admins can embed forms) or if the plugin is deactivated.

CVSS 4.3 (Low-to-Medium) with network vector and low attack complexity reflects the real risk profile: any authenticated WordPress user with Contributor role or above can exploit this remotely without user interaction. However, exploitation requires prior authentication and a non-default WordPress setup where contributors are granted Contributor roles. The flaw is fundamentally about privilege escalation within WordPress rather than unauthenticated remote code execution. EPSS data is not provided, limiting probabilistic exploitation assessment. The primary risk vector is content integrity: attackers can inject shortcodes (potentially leading to arbitrary content insertion, form redirection, or if combined with other flaws, JavaScript execution) into pages they do not own. Active exploitation status is not indicated by CISA KEV listing in provided data, and no public proof-of-concept code is referenced, suggesting this is a logic-based flaw requiring site-specific context rather than a trivially weaponizable vulnerability. The real-world risk depends heavily on site configuration: sites with many contributor-level users face higher risk than those with restricted contributor access.

A WordPress site administrator assigns a staff member Contributor-level access to write blog posts. The attacker (with Contributor credentials) discovers the unprotected embed_form_action() AJAX endpoint and sends a POST request specifying an arbitrary page ID (e.g., a high-traffic homepage or about page owned by the admin) and malicious shortcode content. The endpoint processes the request without verifying the attacker owns or can edit the target page, injecting the shortcode. The next time the page is viewed, the injected shortcode renders, potentially redirecting users to a phishing site or injecting promotional content.