CVE-2020-9457

The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users with minimal privileges to import custom vulnerable forms and change form settings via classrmformsettingscontroller.php, resulting in privilege escalation...

CVE-2020-9456

In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users with minimal privileges to elevate their privileges to administrator via classrmusercontroller.php rmuseredit...

CVE-2020-9456

CVE-2020-9456 affects the WordPress plugin RegistrationMagic (through 4.6.0.3). The issue is in the user controller (class_rm_user_controller.php rm_user_edit), allowing remote authenticated users with minimal privileges to elevate to administrator. According to the connected sources, the vulnera...

CVE-2020-9455

CVE-2020-9455 relates to the WordPress plugin RegistrationMagic (versions up to 4.6.0.3). It allows remote authenticated users with minimal privileges to send arbitrary emails on behalf of the site via the function/class rm_user_services.php send_email_user_view. The vulnerability’s impact is des...

CVE-2020-9455

The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users with minimal privileges to send arbitrary emails on behalf of the site via classrmuserservices.php sendemailuserview...

CVE-2020-9454

A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploa...

CVE-2020-9454

CVE-2020-9454 is a CSRF vulnerability in the WordPress plugin RegistrationMagic (versions up to 4.6.0.3). It allows an attacker to forge requests on behalf of an site administrator to modify plugin settings, including deleting users, creating privileged roles, and enabling PHP file uploads. Multi...

CVE-2020-9458: Missing Authorization

In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users with minimal privileges to export submitted form data and settings via classrmformcontroller.php rmformexport...

CVE-2020-9454: Cross-Site Request Forgery (CSRF)

A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploa...

CVE-2020-9457: Missing Authorization

The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users with minimal privileges to import custom vulnerable forms and change form settings via classrmformsettingscontroller.php, resulting in privilege escalation...

CVE-2020-9456: Missing Authorization

In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users with minimal privileges to elevate their privileges to administrator via classrmusercontroller.php rmuseredit...

CVE-2020-9455: Missing Authorization

The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users with minimal privileges to send arbitrary emails on behalf of the site via classrmuserservices.php sendemailuserview...

RegistrationMagic – Custom Registration Forms and User Login < 4.6.0.4 - Multiple Critical Issues

These allowed an attacker with subscriber-level permissions to elevate their account’s privileges to those of an administrator and to export every form on the site, including all the data that had been submitted to them in the past. Additionally, through a number of unprotected AJAX actions, an...

WordPress RegistrationMagic plugin <= 4.6.0.3 - Multiple Critical vulnerabilities

Multiple Critical vulnerabilities found by Ram Gall in the WordPress RegistrationMagic plugin versions = 4.6.0.3. Solution Update the WordPress RegistrationMagic plugin to the latest available version at least 4.6.0.4...

WordPress RegistrationMagic plugin <= 4.6.0.1 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Spider Sec Ltd. in WordPress RegistrationMagic plugin versions = 4.6.0.1. Solution Update the WordPress RegistrationMagic plugin to the latest available version at least 4.6.0.3...

Registration Magic < 4.6.0.3 - Authenticated SQL Injection via Form_id

The RegistrationMagic – Custom Registration Forms and User Login WordPress plugin was affected by an Authenticated SQL Injection via Formid security vulnerability. PoC https://example.com/wp-admin/admin.php?page=rmanalyticsshowformformid=selectfromselectsleep20atr=30...

WordPress RegistrationMagic plugin <= 4.6.0.1 - Multiple Cross-Site Scripting (XSS) vulnerabilities

Multiple Cross-Site Scripting XSS vulnerabilities found by Spider Sec Ltd. in WordPress RegistrationMagic plugin versions = 4.6.0.1. Solution Update the WordPress Registration Magic plugin to the latest available version at least 4.6.0.3...

RegistrationMagic Plugin for WordPress < 3.7.9.3 PHP Object Injection

According to its self-reported version, the RegistrationMagic Plugin for WordPress running on the remote web server is prior to 3.7.9.3. It is, therefore, affected by a PHP object injection vulnerability. An unauthenticated, remote attacker can exploit this to inject PHP objects, execute arbitrar...

RegistrationMagic - Custom Registration Forms <= 3.8.0.4 - Authenticated Reflected XSS

The RegistrationMagic – Custom Registration Forms and User Login WordPress plugin was affected by a Custom Registration Forms = 3.8.0.4 - Authenticated Reflected XSS security vulnerability. GET...

RegistrationMagic - Custom Registration Forms <= 3.8.0.4 - Authenticated SQL Injection

The RegistrationMagic – Custom Registration Forms and User Login WordPress plugin was affected by a Custom Registration Forms = 3.8.0.4 - Authenticated SQL Injection security vulnerability. PoC GET...