Blind SQL Injection Vulnerability in RegistrationMagic Plugin for WordPress
CVE-2024-1990
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 April 2024
What is CVE-2024-1990?
The RegistrationMagic plugin for WordPress is susceptible to blind SQL injection vulnerabilities through the 'id' parameter of the RM_Form shortcode. This vulnerability arises from inadequate escaping of user-supplied input and insufficient preparation of SQL queries. As a result, authenticated attackers with contributor-level access or higher can insert malicious SQL queries into the existing database queries. The exploitation of this vulnerability could allow unauthorized access to sensitive data stored in the database, posing significant security risks for websites utilizing this plugin.
Affected Version(s)
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login * <= 5.3.1.0