Vulnerability identifier: #VU25801

Vulnerability risk: High

CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-9456

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
RegistrationMagic – Custom Registration Forms and User Login
Web applications / Modules and components for CMS

Vendor: Registrationmagic

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to insufficient capability checks or nonces for functions in the plugin used for administrative purposes. A remote user can send a specially crafted request with the "rm_slug" $_POST parameter set to "rm_user_edit" and the "user_id" parameter set to the user’s ID (which can typically be obtained from the user’s profile page) and change the user’s role to administrator.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

RegistrationMagic – Custom Registration Forms and User Login: 2.5.3 - 4.6.0.3

---

External links
http://wpvulndb.com/vulnerabilities/10116/
http://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.