CVE-2026-92798

Executive Summary

CVE-2026-92798 is an Arbitrary Shortcode Execution vulnerability in the WordPress plugin "User Registration & Membership" affecting versions up to and including 5.2.8. Insufficient input sanitization of the attacker-controlled HTTP_REFERER header in the referrer_url branch of UR_Smart_Tags::process() allows an attacker to inject shortcode delimiters into a Content Restriction message that is later executed via apply_shortcodes()/do_shortcode(). The vulnerability carries a CVSS v3.1 base score of 8.1, reflecting high confidentiality and integrity impact with no availability impact, and could permit unauthenticated attackers to execute arbitrary registered shortcodes on restricted pages that use the {{referrer_url}} smart tag.

Technical Analysis

The flaw resides in the smart-tag processing logic of the User Registration & Membership WordPress plugin. When a restricted page's Content Restriction message includes the supported {{referrer_url}} smart tag, the plugin substitutes the value of the incoming HTTP_REFERER header into that message. Critically, the attacker-controlled referrer value is only passed through sanitize_text_field() before substitution. That function strips tags and certain whitespace/control characters, but it does not remove WordPress shortcode delimiters (the square-bracket shortcode syntax).

Because the substituted Content Restriction message is subsequently rendered through apply_shortcodes()/do_shortcode(), any shortcode delimiters present in the referrer value are interpreted and executed. This means input that should have been treated as inert text is instead processed as shortcode markup, enabling an attacker to invoke arbitrary registered shortcodes.

The vulnerability maps to CWE-94 (Improper Control of Generation of Code — 'Code Injection'), here manifesting as shortcode injection. The attack surface is the HTTP request path: the HTTP_REFERER header is fully client-controllable, so an unauthenticated party can influence the content rendered within a victim's session on a restricted page that uses the vulnerable smart tag.

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N:

• Attack Vector Network (AV:N) — reachable over the web.
• Attack Complexity Low (AC:L) — no special conditions beyond a page using the {{referrer_url}} tag.
• Privileges Required Low (PR:L) — the vector reflects a low-privilege or interacting-user context; note the NVD narrative additionally describes an unauthenticated path via a crafted referrer header.
• User Interaction None (UI:N).
• Confidentiality High (C:H) and Integrity High (I:H): arbitrary shortcode execution may disclose content or alter rendered output; Availability None (A:N).

No public proof-of-concept, Nuclei template, or exploit code is known at the time of writing, and the patch status is only CLAIMED by a single source, so the precise fix has not been independently confirmed.

Exploitation Scenarios

No public PoC available; the attack chain below is inferred from the vulnerability class and NVD description.

1. Reconnaissance / target identification: An attacker identifies a WordPress site running the User Registration & Membership plugin at version 5.2.8 or earlier and locates a Content Restriction message that uses the supported {{referrer_url}} smart tag on a restricted page.

2. Triggering the flaw: The attacker crafts a request to that restricted page with a malicious HTTP_REFERER header value containing WordPress shortcode delimiters. Because the value is only passed through sanitize_text_field(), the shortcode delimiters survive and are substituted into the Content Restriction message rendered on the page.

3. Payload / execution (vulnerability-class level): When the message is rendered via apply_shortcodes()/do_shortcode(), the injected shortcode is executed. The attacker can reference any registered shortcode available in the WordPress installation, and the effects depend on which shortcodes are installed and enabled. No specific shortcode names or payloads are asserted here, as none are provided in the source data.

4. Post-exploitation impact: Depending on the shortcodes available, execution may expose data, alter rendered page content, or otherwise abuse plugin/theme functionality. The high confidentiality and integrity scores reflect this potential for information disclosure and content manipulation.

Impact Assessment

Successful exploitation allows arbitrary registered shortcode execution in the context of the vulnerable page, with high confidentiality and integrity impact and no direct availability impact per the CVSS subscores. Business risk includes exposure of restricted content and manipulation of page output for users who reach a page whose Content Restriction message relies on the {{referrer_url}} smart tag. Because the referrer header is client-controllable, exploitation can be attempted without authentication against any qualifying restricted page; blast radius scales with the number of sites running the affected plugin versions and the set of shortcodes registered on each installation. The CVSS base score of 8.1 (High) and CWE-94 classification place this among higher-priority WordPress plugin issues, though absence of a confirmed patch and of any known in-the-wild exploitation tempers urgency for immediate weaponization tracking.

Detection Guidance

Sigma Rule

title: WordPress User Registration Referrer Shortcode Injection Attempt
id: 3f8c2d9a-7b41-4e6a-9c15-2d8e5f1a6b07
status: experimental
description: Detects requests carrying shortcode delimiters in the HTTP Referer header targeting pages that use the {{referrer_url}} smart tag (CVE-2026-92798).
logsource:
  category: webserver
  product: apache
detection:
  selection_referer:
    cs-method: 'GET'
    cs-referer|contains:
      - '['
      - ']'
  filter_benign:
    cs-referer|startswith:
      - 'https://'
      - 'http://'
    cs-referer|contains: 'shortcode'
  condition: selection_referer and not filter_benign
fields:
  - c-ip
  - cs-uri
  - cs-referer
falsepositives:
  - Legitimate URLs containing encoded brackets in the referrer
level: medium
tags:
  - attack.t1190
  - cve.2026.92798

YARA Rule

rule WP_URM_Referrer_Shortcode_Injection
{
    meta:
        description = "Detects shortcode delimiters embedded in HTTP Referer headers consistent with CVE-2026-92798"
        author = "Threat Intelligence"
        reference = "CVE-2026-92798"
        date = "2026-01-01"
    strings:
        $ref = /Referer:[ \t]*[^\r\n]*\[[^\r\n]*\]/ nocase
        $plugin = "user-registration" nocase
        $tag = "referrer_url" nocase
    condition:
        $ref and ($plugin or $tag)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92798 User Registration referrer shortcode injection attempt"; flow:established,to_server; http.header; content:"Referer"; nocase; pcre:"/Referer\s*:\s*[^\r\n]*\[[^\r\n]*\]/i"; classtype:web-application-attack; reference:cve,2026-92798; sid:202692798; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "GET"
      and http.request.referrer : "*\\[*\\]*" ]
  [ network where network.protocol == "http"
      and url.path : "*restricted*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval ref=lower(coalesce(cs_referer, referer, http_referer))
| where match(ref, "\[|\]")
| stats count values(cs_uri) as uris by src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-92798,">
  <rule id="100927" level="10">
    <if_group>web|accesslog</if_group>
    <regex type="pcre2">Referer:\s*[^\r\n]*\[[^\r\n]*\]</regex>
    <description>CVE-2026-92798: HTTP Referer contains shortcode delimiters (possible User Registration shortcode injection)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). No specific fixed version is confirmed in the source data, so the following should be treated as prudent measures pending an independently verified vendor advisory.

1. Immediate mitigations: Remove or disable the {{referrer_url}} smart tag from any Content Restriction message on restricted pages until a verified fix is applied. If the tag cannot be removed, restrict access to pages relying on it, or deactivate Content Restriction features that render this tag. Because the flaw is header-driven, WAF rules that reject HTTP Referer values containing shortcode square-bracket delimiters can reduce exposure, though this should be validated against legitimate traffic.

2. Patch/upgrade steps: Monitor the vendor's official plugin changelog and the NVD entry for CVE-2026-92798 to identify the confirmed fixed version. Since patch status is only CLAIMED, do not assume 5.2.8 is the final affected release; verify a fixed release exists before upgrading, then update the plugin through the WordPress admin or WP-CLI and validate plugin settings post-upgrade.

3. Long-term hardening: Enforce least-privilege on who can edit Content Restriction messages, avoid relying on server-supplied headers (such as Referer) inside rendered/executed shortcode contexts, deploy context-aware WAF protection for WordPress plugins, and maintain continuous vulnerability scanning of plugin inventories. Restrict registered shortcodes to trusted, vetted sources.

References

• NVD — CVE-2026-92798: https://nvd.nist.gov/vuln/detail/CVE-2026-92798
• CWE-94 (Improper Control of Generation of Code 'Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• WordPress Plugin Security documentation: https://wordpress.org/plugins/
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (for status check; CVE-2026-92798 not listed as of publication): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence is currently associated with CVE-2026-92798 based on the provided data; no public PoC, exploit code, or Nuclei template is known.