CVE-2020-9457 - The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation

Back Back to CVE browser

HIGH

The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation

Published Mar 6, 2020

8.8

HIGH

CVSS 3.1

EPSS 2.53%

Description

The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30276
Advisory
https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers
x_refsource_MISCThird Party Advisory
https://wpvulndb.com/vulnerabilities/10116
x_refsource_MISCThird Party Advisory
https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30276		Advisory
https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers		x_refsource_MISCThird Party Advisory
https://wpvulndb.com/vulnerabilities/10116		x_refsource_MISCThird Party Advisory
https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/		x_refsource_MISCExploitThird Party Advisory