CVSS: 9.9EPSS: 1%CPEs: 1EXPL: 1CVE-2020-9457 – RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings Import to Privilege Escalation
https://notcve.org/view.php?id=CVE-2020-9457
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation. El plugin RegistrationMagic versiones hasta 4.6.0.3 para WordPress, permite a usuarios autenticados remotos (con privilegios mínimos) importar formularios vulnerables personalizados y cambiar la configuración de los formularios por medio del archivo class_rm_form_settings_controller.php, resultando en una escalada de privilegios. • https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers https://wpvulndb.com/vulnerabilities/10116 https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 1CVE-2020-9454 – RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Cross-Site Request Forgery to Settings Modification
https://notcve.org/view.php?id=CVE-2020-9454
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms. Una vulnerabilidad de tipo CSRF en el plugin RegistrationMagic versiones hasta 4.6.0.3 para WordPress, permite a atacantes remotos falsificar peticiones en nombre del administrador del sitio para cambiar todas las configuraciones del plugin, incluyendo el borrado de usuarios, la creación de roles nuevos con privilegios escalados, y permitir una carga de archivos PHP por medio de formularios. • https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers https://wpvulndb.com/vulnerabilities/10116 https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 1CVE-2020-9458 – RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings and User Data Export
https://notcve.org/view.php?id=CVE-2020-9458
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export. En el plugin RegistrationMagic versiones hasta 4.6.0.3 para WordPress, la función export permite a usuarios autenticados remotos (con privilegios mínimos) exportar los datos y configuraciones de los formularios enviados por medio de la función rm_form_export del archivo class_rm_form_controller.php. • https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers https://wpvulndb.com/vulnerabilities/10116 https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2020-9455 – RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Email Injection
https://notcve.org/view.php?id=CVE-2020-9455
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view. En el plugin RegistrationMagic versiones hasta 4.6.0.3 para WordPress, permite a usuarios autenticados remotos (con privilegios mínimos) enviar correos electrónicos arbitrarios en nombre del sitio por medio de la función send_email_user_view del archivo class_rm_user_services.php. • https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers https://wpvulndb.com/vulnerabilities/10116 https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin • CWE-862: Missing Authorization •
CVSS: 9.9EPSS: 1%CPEs: 1EXPL: 1CVE-2020-9456 – RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Privilege Escalation
https://notcve.org/view.php?id=CVE-2020-9456
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit. En el plugin RegistrationMagic versiones hasta 4.6.0.3 para WordPress, el controlador de usuario permite a usuarios autenticados remotos (con privilegios mínimos) escalar sus privilegios a administrador por medio de la función rm_user_edit del archivo class_rm_user_controller.php. • https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers https://wpvulndb.com/vulnerabilities/10116 https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin • CWE-862: Missing Authorization •