CVE-2025-2563

This repository contains a functional Python exploit for CVE-2025-2563, targeting a WordPress membership plugin vulnerability. The exploit automates user registration, email bypass, and admin privilege escalation through crafted HTTP requests and nonce extraction.

The repository contains a functional Python exploit for CVE-2025-2563, targeting a WordPress membership plugin vulnerability. The script automates user registration and privilege escalation by extracting nonces and form data from the target site.

This repository provides a detailed writeup and proof-of-concept for CVE-2025-2563, an unauthenticated privilege escalation vulnerability in the User Registration & Membership WordPress plugin. The exploit allows attackers to create administrator accounts under specific conditions.

This Metasploit module exploits CVE-2025-2563 in the WordPress User Registration & Membership plugin, allowing unauthenticated privilege escalation to administrator by registering a user, elevating privileges via AJAX, and uploading/executing a PHP payload.