Unrated severityNVD Advisory· Published Mar 6, 2020· Updated Aug 4, 2024

CVE-2020-9454

Description

A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

RegistrationMagic/RegistrationMagic plugindescription
WordPress/Custom Registration Form Builder With Submission Managerllm-fuzzy
Range: <=4.6.0.3
Package: https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager
WordPress/Registrationmagicllm-fuzzy
Range: <=4.6.0.3

Patches

Vulnerability mechanics

References

wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/mitrex_refsource_MISC
wpvulndb.com/vulnerabilities/10116mitrex_refsource_MISC
www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/mitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000