CVE-2026-3601 — The User Registration & Membership plugin for WordPress is

title: CVE-2026-3601 - WordPress User Registration Plugin - Unauthorized Shortcode Appending
id: scw-2026-05-05-ai-1
status: experimental
level: medium
description: |
  Detects the exploitation of CVE-2026-3601 in the User Registration & Membership plugin for WordPress. This rule specifically looks for the 'embed_form_action' AJAX action being called, which is vulnerable due to a missing capability check. Attackers can use this to append shortcode content to arbitrary pages, potentially leading to unauthorized content modification or further compromise. This rule targets authenticated users with Contributor-level access or above.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-3601/
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin-ajax.php'
      cs-method:
          - 'POST'
      cs-uri-query|contains:
          - 'action=embed_form_action'
  selection_base:
      sc-status:
          - 200
      condition: selection AND selection_base
  selection_indicators:
      referer|contains:
          - '/wp-admin/'
      condition: selection AND selection_base AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse