The User Registration & Membership plugin for WordPress contains a flaw that allows an attacker to run arbitrary shortcodes by exploiting an insufficiently sanitized "referrer_url" custom tag. The value supplied via the HTTP_REFERER header is passed through sanitize_text_field()—which does not strip WordPress shortcode delimiters—before being inserted into a content restriction message and subsequently processed by apply_shortcodes()/do_shortcode(). This means an attacker can cause any registered shortcode to execute on a restricted page whose message uses the {{referrer_url}} smart tag.

WordPress sites running versions 5.2.8 or earlier of the User Registration & Membership plugin from the vendor wpeverest are affected. The vulnerability manifests when a content‑restriction message includes the {{referrer_url}} smart tag.

The flaw has a CVSS score of 8.1, indicating high severity, and the EPSS score is not available. Because the attack vector is the HTTP_REFERER header, it can be triggered over the network from any user that can craft that header; no authentication is required beyond access to a restricted page. The path to exploitation is straightforward: craft a request to the target with a malicious Referer value containing a shortcode, and the plugin will execute it on the page.