A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.
References
Link | Resource |
---|---|
https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers | Third Party Advisory |
https://wpvulndb.com/vulnerabilities/10116 | Third Party Advisory |
https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/ | Exploit Third Party Advisory |
Configurations
History
No history.
Information
Published : 2020-03-06 19:15
Updated : 2024-02-28 17:28
NVD link : CVE-2020-9454
Mitre link : CVE-2020-9454
CVE.ORG link : CVE-2020-9454
JSON object : View
Products Affected
metagauss
- registrationmagic
CWE
CWE-352
Cross-Site Request Forgery (CSRF)