The User Registration & Membership plugin for WordPress allows authenticated users with subscriber-level access or higher to invoke the WordPress do_shortcode function without validating the input. This flaw lets an attacker inject any shortcode, including ones that execute PHP code, resulting in arbitrary code execution within the WordPress environment. The vulnerability can lead to full site compromise if the injected shortcode contains malicious logic.

WordPress installations that use the User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin from wpeverest, version 5.2.8 or older are affected. No publicly available information indicates that later releases address the issue; therefore, any site running affected versions remains vulnerable.

The CVSS score of 5.4 classifies the issue as moderate severity. The EPSS score of <1% indicates a very low probability of exploitation and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user, so the attack vector is internal or through a compromised account. While no public exploit has been reported, the potential impact of code execution warrants prompt remediation.