WordPress RegistrationMagic plugin <= 5.2.3.0 - Broken Access Control vulnerability
CVE-2023-49831

7.5HIGH

Key Information:

Vendor
WordPress
Status
Registrationmagic
Vendor
CVE Published:
9 December 2024

Summary

A missing authorization vulnerability exists in the user registration forms provided by the RegistrationMagic plugin from Metagauss. This flaw permits unauthorized users to exploit incorrectly configured access control security levels, potentially compromising sensitive data and user permissions. The vulnerability is present in all versions prior to 5.2.3.0, creating a significant security risk for WordPress sites utilizing the RegistrationMagic plugin.

Affected Version(s)

RegistrationMagic <= 5.2.3.0

References

https://patchstack.com/database/wordpress/plugin/custom-r...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lttn (Patchstack Alliance)
.