CVE-2023-23976 - WordPress RegistrationMagic plugin <= 5.1.9.2

Back Back to CVE browser

HIGH

WordPress RegistrationMagic plugin <= 5.1.9.2 - Arbitrary Price Change

Published Apr 24, 2024

7.5

HIGH

CVSS 3.1

EPSS 0.46%

Description

Incorrect Default Permissions vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.1.9.2.

Affected products

Vendor Metagauss Product RegistrationMagic Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=5.1.9.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Metagauss

RegistrationMagic

unaffected

Version	Status	Constraints
-	affected	<=5.1.9.2

Vendor Metagauss Product Registrationmagic Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=5.1.9.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Metagauss

Registrationmagic

n/a

Version	Status	Constraints
0	affected	<=5.1.9.2

Remediation

Vendor solution

Update to 5.1.9.3 or a higher version.

Weaknesses (1)

CWE-276

Incorrect Default Permissions

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-28040		Advisory
https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-custom-registration-forms-user-registration-and-user-login-plugin-plugin-5-1-9-2-arbitrary-price-change?_s_id=cve		vdb-entryThird Party Advisory