Arbitrary Shortcode Execution in User Registration Plugin for WordPress
CVE-2026-15222

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Vendor
CVE Published:
16 October 2026

What is CVE-2026-15222?

The User Registration & Membership plugin for WordPress is susceptible to arbitrary shortcode execution across all versions up to and including 5.2.8. This vulnerability arises due to insufficient validation of user input, enabling authenticated users with subscriber-level access or higher to execute arbitrary shortcodes on the site. Attackers can exploit this flaw to manipulate content and perform unauthorized actions, underscoring the importance of updating the plugin to the latest version to mitigate potential security risks.

Affected Version(s)

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 0 <= 5.2.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3741339/user...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hashiramasenju333
.