by Kastro
Paper/Archive/CVE-2023-2499

CVE-2023-2499

metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login — RegistrationMagic <= 5.2.1.0 - Authentication Bypass

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 70.5.705 × 2014.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verification on the user being supplied during a Google social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.

Affected

ProductAffectedFixed inSource
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login≤ 5.2.1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/87ec5542-b6e7-4b18-a3ec-c258e749d32e?source=cverefplugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/5.2.0.4/services/class_rm_user_services.php#L791refplugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912481%40custom-registration-form-builder-with-submission-manager&new=2912481%40custom-registration-form-builder-with-submission-manager&sfp_email=&sfph_mail=