Add Unauthenticated privesc for WP User Registration & Membership plugin (CVE-2025-2563)

[Chocapikk]

Hello Metasploit Team,

This change adds a new module, exploit/multi/http/wp_user_registration_membership_escalation.rb, which targets CVE-2025-2563 in the WordPress User Registration & Membership plugin (Free < 4.1.2, Pro < 5.1.2). When the Membership Addon is enabled, the plugin fails to enforce role restrictions on its unauthenticated AJAX endpoint, allowing anyone to register a new account and assign it the administrator role.

Verification

• Start msfconsole

• use exploit/multi/http/wp_user_registration_membership_escalation

• Set the required options:

  • RHOSTS to the target IP or hostname
  • TARGETURI to the WordPress base path (default /)
  • (Optional) WP_USER, WP_PASS, WP_EMAIL for the new admin account

• Check for vulnerability: check

• Exploit the target: exploit

  You should see output indicating an administrator user was created:

  [+] Administrator created: <username>:<password>
  

• Verify:

  • Browse to /wp-login.php or /login/
  • Log in with the newly created credentials
  • Confirm you have administrator privileges (e.g., access /wp-admin/ and see the Dashboard)