Volerion logoVolerion
Volerion logoVolerion

WordPress User Registration Plugin Missing Authorization Vulnerability Allowing Arbitrary Shortcode Execution

Vulnerability

A missing authorization vulnerability has been identified in the WordPress User Registration plugin, specifically in versions through 4.4.9. This vulnerability allows unprivileged users to execute arbitrary shortcodes, exploiting incorrectly configured access control security levels.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of shortcodes, potentially allowing attackers to execute malicious actions or code on behalf of the user.

Remediation

Users of the WordPress User Registration plugin should update to version 5.0 or later. Patchstack users can enable auto-update for vulnerable plugins.

Added: Jan 22, 2026, 7:22 PM
Updated: Jan 22, 2026, 7:22 PM

Vulnerability Rating

Custom Algorithm
spread
3.4
impact
10.0
exploitability
5.4
remediation
7.7
relevance
2.2
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.