631 matches found
CVE-2020-9456
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users with minimal privileges to elevate their privileges to administrator via classrmusercontroller.php rmuseredit...
CVE-2020-9455
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users with minimal privileges to send arbitrary emails on behalf of the site via classrmuserservices.php sendemailuserview...
CVE-2020-9455
CVE-2020-9455 relates to the WordPress plugin RegistrationMagic (versions up to 4.6.0.3). It allows remote authenticated users with minimal privileges to send arbitrary emails on behalf of the site via the function/class rm_user_services.php send_email_user_view. The vulnerability’s impact is des...
CVE-2020-9455
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users with minimal privileges to send arbitrary emails on behalf of the site via classrmuserservices.php sendemailuserview...
CVE-2020-9454
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploa...
CVE-2020-9454
CVE-2020-9454 is a CSRF vulnerability in the WordPress plugin RegistrationMagic (versions up to 4.6.0.3). It allows an attacker to forge requests on behalf of an site administrator to modify plugin settings, including deleting users, creating privileged roles, and enabling PHP file uploads. Multi...
CVE-2020-9454
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploa...
PT-2020-20669
Name of the Vulnerable Software and Affected Versions RegistrationMagic plugin versions prior to 4.6.0.4 Description The issue allows remote authenticated users with minimal privileges to send arbitrary emails on behalf of the site. This is achieved via the send email user view functionality in...
PT-2020-20668
Name of the Vulnerable Software and Affected Versions RegistrationMagic plugin versions through 4.6.0.3 Description A CSRF issue allows remote attackers to forge requests on behalf of a site administrator to change plugin settings, including deleting users, creating new roles with escalated...
PT-2020-20672
Name of the Vulnerable Software and Affected Versions RegistrationMagic plugin versions prior to 4.6.0.4 Description The issue allows remote authenticated users with minimal privileges to export submitted form data and settings. This is achieved through the export function in the RegistrationMagi...
PT-2020-20671
Name of the Vulnerable Software and Affected Versions RegistrationMagic plugin versions prior to 4.6.0.4 Description The issue allows remote authenticated users with minimal privileges to import custom vulnerable forms and change form settings via the class rm form settings controller.php file,...
PT-2020-20670
Name of the Vulnerable Software and Affected Versions RegistrationMagic plugin versions prior to 4.6.0.4 Description The issue allows remote authenticated users with minimal privileges to elevate their privileges to administrator. This is achieved through the user controller in the class rm user...
CVE-2020-9458: Missing Authorization
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users with minimal privileges to export submitted form data and settings via classrmformcontroller.php rmformexport...
CVE-2020-9457: Missing Authorization
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users with minimal privileges to import custom vulnerable forms and change form settings via classrmformsettingscontroller.php, resulting in privilege escalation...
CVE-2020-9456: Missing Authorization
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users with minimal privileges to elevate their privileges to administrator via classrmusercontroller.php rmuseredit...
CVE-2020-9454: Cross-Site Request Forgery (CSRF)
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploa...
CVE-2020-9455: Missing Authorization
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users with minimal privileges to send arbitrary emails on behalf of the site via classrmuserservices.php sendemailuserview...
RegistrationMagic – Custom Registration Forms and User Login < 4.6.0.4 - Multiple Critical Issues
These allowed an attacker with subscriber-level permissions to elevate their account’s privileges to those of an administrator and to export every form on the site, including all the data that had been submitted to them in the past. Additionally, through a number of unprotected AJAX actions, an...
WordPress RegistrationMagic plugin <= 4.6.0.3 - Multiple Critical vulnerabilities
Multiple Critical vulnerabilities found by Ram Gall in the WordPress RegistrationMagic plugin versions = 4.6.0.3. Solution Update the WordPress RegistrationMagic plugin to the latest available version at least 4.6.0.4...
Registration Magic < 4.6.0.3 - Authenticated SQL Injection via Form_id
The RegistrationMagic – Custom Registration Forms and User Login WordPress plugin was affected by an Authenticated SQL Injection via Formid security vulnerability. PoC https://example.com/wp-admin/admin.php?page=rmanalyticsshowformformid=selectfromselectsleep20atr=30...