CVE-2026-15222: CWE-94 Improper Control of Generation of Code ('Code Injection') in wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

CVE-2026-15222 is a code injection vulnerability (CWE-94) in the User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder WordPress plugin. The flaw exists in all versions up to 5.2.8, where the plugin improperly controls the generation of code by allowing authenticated users with subscriber-level privileges or above to execute arbitrary shortcodes via insufficient validation before calling do_shortcode.

An attacker with subscriber-level access or higher can execute arbitrary shortcodes, potentially leading to limited code execution within the context of the WordPress site. The CVSS score of 5.4 (medium severity) reflects that the impact includes limited confidentiality and integrity loss but no availability impact. There are no known exploits in the wild.

No official patch or remediation link is provided in the data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities where possible and monitor for suspicious shortcode usage.