CVE-2026-1492

GitHubCurated repository PoCExploitC++SecureWithUmer/CVE-2026-PoCs

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that implements a full, multi-stage attack chain to exploit CVE-2026-1492. It automatically discovers vulnerable WordPress sites, registers new users, injects an 'administrator' role via a crafted AJAX request, and verifies the resulting admin access.

Backdoor review

No backdoor observed in reviewed code

The PoC script CVE-2026-1492.py implements a multi-step exploit chain against a known WordPress plugin vulnerability (CVE-2026-1492). It performs automated discovery, user registration, and role injection to escalate privileges to administrator. All observed behavior is consistent with the stated exploit goal. No concealed backdoor, unrelated payload, or deceptive operator-directed harm was found in the reviewed source code or README.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareWordPressUser Registration & Membership plugin
Attack typesprivilege escalationunauthorized account creation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Python script that actively exploits CVE-2026-1492 by performing unauthorized privilege escalation. It registers a user and then sends a crafted AJAX request to inject an 'administrator' role, which is the core exploit action. The README explicitly describes it as a 'Proof-of-Concept (PoC) exploitation script'.

Nxploited-CVE-2026-1492-d0e78b1/README.md:45Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:743-753

Requirements

  • Target must be a WordPress site running the User Registration & Membership plugin version <= 5.1.2.Nxploited-CVE-2026-1492-d0e78b1/README.md:33
  • The target site must have a membership registration page and the vulnerable AJAX handler accessible.Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:144-202

Observed behavior

  • Discovers candidate registration and pricing pages on the target WordPress site.Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:144-202
  • Extracts membership plan IDs, form nonces, and AJAX parameters from the discovered pages.Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:205-431
  • Registers a new user account via the 'user_registration_user_form_submit' AJAX action.Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:638-739
  • Sends a crafted 'user_registration_membership_register_member' AJAX request with 'role': 'administrator' in the 'members_data' payload to escalate privileges.Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:743-753Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:756-842
  • Verifies the created account has administrator privileges by logging in and checking for admin dashboard indicators.Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:934-1072
  • Writes successfully created admin credentials to a file named 'Nx_admin.txt'.Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:100-102
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script sends AJAX requests to register a user and then injects an 'administrator' role via the vulnerable membership endpoint.This is the core exploit logic for CVE-2026-1492, as described in the CVE context and README.Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:638-739Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:743-842
Credential Logging
The script writes successfully created administrator credentials to a local file Nx_admin.txt.This is a standard output mechanism for a PoC exploit, logging the results of the attack for the operator.Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:100-102
Hardcoded Password
The script uses a default password 'Nx_12999' for created accounts.This is a fixed password for the exploit, not a backdoor credential. It is user-configurable.Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:40
Review boundaries

What the analysis did not establish

  • Evidence coverage is COMPLETE_FOR_READABLE_SELECTED_TEXT, but one unclassified file of 1480 bytes was omitted from the packet. The analysis is based on the provided Python script and README.
  • The artifact's behavior is analyzed from its source code; the code was not executed, and its effectiveness or safety is not verified.
  • The review is limited to the two text files provided in the evidence packet. No binary files were present.
  • The script's behavior depends on external network interactions with target WordPress sites, which were not observed.
  • The script imports standard third-party libraries (requests, rich) which were not reviewed for supply-chain risks.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1