Insecure Direct Object References in RegistrationMagic Plugin for WordPress
CVE-2023-2548
7.2HIGH
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 16 May 2023
Summary
The RegistrationMagic plugin for WordPress has a vulnerability that allows authenticated users to bypass authorization and gain unauthorized access to sensitive system resources. Specifically, versions up to and including 5.2.0.5 permit attackers with administrative privileges to manipulate user access, which can result in the alteration of user passwords and the potential compromise of super-administrator accounts within a multisite environment.
Affected Version(s)
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login * <= 5.2.0.5
References
CVSS V3.1
Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Lana Codes