Nxploited/CVE-2026-1492

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that automates the full exploitation chain for CVE-2026-1492, an unauthenticated privilege escalation vulnerability in the WordPress User Registration & Membership plugin. The script discovers vulnerable endpoints, registers a new user, and injects an 'administrator' role via a crafted AJAX request to create a privileged account.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a Python script that exploits CVE-2026-1492 to create administrator accounts on vulnerable WordPress sites. It performs automated discovery, registration, and role-injection steps exactly as described in the README. No concealed backdoor, unrelated payload, or deceptive behavior was observed in the reviewed text.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareWordPressUser Registration & Membership plugin
Attack typesprivilege escalationaccount creation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional Python script that actively exploits CVE-2026-1492 by sending crafted HTTP requests to vulnerable WordPress sites to create administrator accounts. It does not merely detect or report the vulnerability; it performs the privilege escalation.

CVE-2026-1492.py:638-739CVE-2026-1492.py:743-753README.md:45

Requirements

  • Target must run a vulnerable version (<= 5.1.2) of the User Registration & Membership plugin.README.md:33
  • The target's registration and membership AJAX endpoints must be accessible.CVE-2026-1492.py:638-654

Observed behavior

  • Discovers membership plans and registration pages by crawling common paths like /membership-pricing/ and /registration/.CVE-2026-1492.py:144-202
  • Extracts nonces, form IDs, and AJAX parameters from the registration page HTML.CVE-2026-1492.py:277-431
  • Registers a new user account via the user_registration_user_form_submit AJAX action.CVE-2026-1492.py:638-739
  • Sends a second AJAX request (user_registration_membership_register_member) with a members_data payload containing '"role": "administrator"' to escalate privileges.CVE-2026-1492.py:743-753
  • Verifies the created account has administrative access by logging in and checking for admin dashboard indicators.CVE-2026-1492.py:1013-1072
  • Writes successfully created admin credentials to a file (Nx_admin.txt).CVE-2026-1492.py:100-102
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script sends HTTP requests to register a user and then injects an administrator role via the membership AJAX handler.This is the documented exploit for CVE-2026-1492 and matches the vulnerability description.CVE-2026-1492.py:638-739CVE-2026-1492.py:756-842
Credential Storage
Successful admin credentials are written to Nx_admin.txt and membership_success_log.txt.This is standard output logging for a PoC tool and does not indicate exfiltration to an external party.CVE-2026-1492.py:100-107
Author Contact
The script and README display author handles (Nxploited, @Kxploit, @KNxploited) and links.Author attribution is present but does not constitute backdoor behavior.CVE-2026-1492.py:85README.md:293-301
Review boundaries

What the analysis did not establish

  • One file (requirements.txt) was omitted from the evidence due to size constraints, but its content is described in the README and is not essential for classification.
  • The evidence does not include the execution output of the script; classification is based solely on static analysis of the provided source code.
  • One file (requirements.txt) was omitted from the text evidence; its metadata shows it is a small dependency list and is unlikely to contain backdoor logic.
  • Binary content was not present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1