Unauthenticated Attackers Can Escalate Privileges via Plugin Flaw

CVE-2024-10508

Summary

The RegistrationMagic User Registration Plugin for WordPress is susceptible to a serious vulnerability that allows unauthenticated attackers to escalate privileges via account takeover. This issue stems from the plugin's inadequate validation of password reset tokens prior to allowing updates to user passwords. As a result, attackers can reset passwords for arbitrary users, including those with administrative privileges, and gain unauthorized access to sensitive accounts. The vulnerability exists in all versions up to and including 6.0.2.6, necessitating immediate attention and patching to mitigate risks associated with potential exploitation.

References