WordPress User Registration Checker for CVE-2026-1492

Read-only checker for owned WordPress sites that may be affected by CVE-2026-1492 in the User Registration & Membership plugin.

It helps a site owner confirm plugin exposure and look for compromise indicators such as hidden administrator accounts, suspicious uploads, cron entries, and tampered files.

Start Here

Ping7 resources

• All GitHub tools: https://ping7.cc/github-tools/
• Full self-check guide: https://ping7.cc/cve/wordpress-1492/
• CVE repair service: https://ping7.cc/cve-repair/
• Sample repair report: https://ping7.cc/cve-repair/sample-report/
• Live CVE alerts: https://t.me/ping7cve

Issue or repair

Open a GitHub issue when the checker crashes, gives an unclear result, flags a false positive, or needs documentation cleanup. Keep the example non-sensitive.

Use Ping7 repair when the result is SUSPICIOUS or COMPROMISED, or when the evidence includes live domains, customer data, private logs, admin usernames, upload filenames, or database details that should not be posted in public.

Evidence to keep

• Checker output and version.
• WordPress path, host type, and plugin version.
• First suspicious timestamp.
• Unknown admin account names, sanitized if needed.
• Upload PHP filenames, cron entries, redirects, or changed theme files.
• Whether access logs and database backups are still available.

Use This Repo When

• You operate the WordPress site or have explicit approval to review it.
• The User Registration plugin was present during the patch window.
• A new administrator account, upload PHP file, cron entry, or redirect appeared without a clear owner.
• You need a terminal result that can be pasted into a repair ticket.
• You want a first pass before paying for cleanup or compromise review.

Quick Start

Run from the WordPress root directory, where wp-config.php exists:

curl -fsSLO https://raw.githubusercontent.com/limo57640-crypto/wp-user-registration-vuln-checker/main/check.sh
less check.sh
bash check.sh

Or pass the WordPress path:

bash check.sh /home/example/public_html

What It Checks

Output

• CLEAN: no obvious indicators found.
• SUSPICIOUS: needs manual review.
• COMPROMISED: strong compromise indicators found.
• ERROR: script could not complete.

Sample Output

WordPress User Registration CVE-2026-1492 Checker

Checks run:     12
Suspicious:     1
Compromised:    0

STATUS: SUSPICIOUS - INVESTIGATE FURTHER
Some checks need manual review.
Guide: https://ping7.cc/cve/wordpress-1492

Exit Codes

Limitations

• It does not replace a full WordPress incident response.
• It can only read files and database state available to the current user.
• Deleted logs, disabled shell access, or managed-hosting restrictions can hide useful evidence.
• A clean result does not prove the site was never attacked.

Repair Handoff

If the result is SUSPICIOUS or COMPROMISED, keep the output and send:

Domain:
WordPress path or host type:
CVE: CVE-2026-1492
Plugin version:
Detector result: CLEAN / SUSPICIOUS / COMPROMISED / ERROR
Symptoms: unknown admin, upload PHP file, redirect, cron, changed theme file, or scanner result
Logs still available: yes / no

Do not send passwords in the first message. Send symptoms, timestamps, screenshots, and sanitized log snippets.

What To Do If It Finds Something

1. Do not delete files immediately. Preserve evidence first.
2. Take a backup or provider snapshot.
3. Patch the plugin and WordPress stack.
4. Remove unauthorized admin accounts after preserving details.
5. Review uploads, cron, theme files, and access logs.

Need repair help: https://ping7.cc/cve-repair

Contributing

Open an issue for a false positive, a missed defensive signal, or a hosting environment that the checker handles poorly. Include plugin version, WordPress version, host type, and sanitized output. Do not post passwords, API keys, customer data, or live attack strings.

Defensive Scope

This checker is for owned or client-approved WordPress sites only. It does not exploit the vulnerability and does not modify files.

No payloads. No broad scanning. No exploitation steps.

License

MIT