#VU25805 Permissions, Privileges, and Access Controls in RegistrationMagic - Custom Registration Forms and User Login - CVE-2020-9457

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to unprotected "upload_template()","import_form_first_ajax()","view()" and "set_default_form()" AJAX actions. A remote authenticated attacker can upload a customized "vulnerable" registration form, then use the data export vulnerability to grab the information they need to launch the next step: by using yet another unprotected AJAX action, they can set an existing form on the site to expire after 0 submissions and replace it with their newly uploaded form. Once the vulnerable form is active, the attacker can register as an administrator.

If no forms are published, but the plugin’s “Magic Button” functionality is enabled, an attacker can also use an unprotected AJAX action to set their uploaded form as the “Default” form, which can be submitted from anywhere on the site.

Remediation

External links

• https://wpvulndb.com/vulnerabilities/10116/
• https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/