CVE-2026-1492 - WordPress User Registration Plugin Privilege Escalation Exploit

Description

This repository contains a proof-of-concept exploit for CVE-2026-1492, a critical vulnerability affecting the WordPress User Registration & Membership plugin.

The vulnerability allows unauthenticated attackers to create administrator accounts by abusing the membership registration process.

👉 A full technical analysis of this vulnerability is available here:
Technical Analysis
It explains step-by-step how the backend processes attacker-controlled data and why the privilege escalation is possible.

Vulnerability Details

• CVE ID: CVE-2026-1492
• Component: User Registration & Membership Plugin (WPEverest)
• Affected Versions: <= 5.1.2
• Vulnerability Type: Improper Privilege Management (CWE-269)
• Authentication Required: No
• CVSS Score: 9.8 (Critical)

Root Cause

The plugin improperly trusts user-controlled input during the membership registration process.

Specifically:

• The backend accepts a user-supplied role
• No server-side allowlist is enforced
• The role is directly applied to the created user

This allows attackers to set:

"role": "administrator"

and gain full administrative access.

Impact

Successful exploitation allows:

• Full WordPress admin access
• Installation of malicious plugins/themes
• Arbitrary PHP code execution (via admin panel)
• Database exfiltration
• Complete site takeover

Exploitation Flow

The vulnerability is triggered through a multi-step AJAX process:

1. Retrieve CSRF tokens and form identifiers
2. Register a user via user_registration_user_form_submit
3. Trigger membership registration via user_registration_membership_register_member
4. Inject a malicious role parameter (administrator)

Exploit Features

• Automatic token extraction (nonce, form_id, security)
• Automatic membership ID extraction
• Session handling (cookies)
• Clean CLI output
• Debug mode for request inspection

Usage

python3 exploit.py -t http://target -ru 'http://target/?page_id=6'

Example

python3 exploit.py -t http://localhost:5000 -ru 'http://localhost:5000/?page_id=6'

Output

[*] Extracting tokens...
[+] form_id: 5
[+] frontend_nonce: XXXXX
[+] security: XXXXX
[+] wpnonce: XXXXX
[+] membership_id: 12

[*] Sending registration request...
[+] User created

[*] Sending membership request...
[+] Privilege escalation successful

Post-Exploitation

Login using the generated credentials:

http://target/wp-login.php

Then access the admin panel:

http://target/wp-admin/

Note: The admin path may be customized.

Mitigation

• Update plugin to version >= 5.1.3
• Disable the plugin if patching is not possible
• Monitor for unauthorized admin account creation

Disclaimer

This exploit is provided for educational purposes and authorized security testing only.

Do not use against systems without permission.

References

• CVE-2026-1492 (NVD)
• Wordfence Advisory
• Public exploitation reports