CVE-2017-20208criticalexploração observadaCWE-502

CVE-2017-20208: falha crítica em metagauss RegistrationMagic – Custom…

RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

50Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Actcvss 9.8epss 0.7%
da publicação à arma
Publicada no NVD18 de out.
VulnCheck2 de out.
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
metagauss · RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
CVEs relacionadas — metagauss RegistrationMagic – Custom…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-15403CRITICALRegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_orderEPSS 1.7%CVE-2024-10508CRITICALRegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password RecoveryEPSS 1.5%CVE-2023-2499CRITICALRegistrationMagic <= 5.2.1.0 - Authentication BypassEPSS 1.3%CVE-2024-1991HIGHRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.9%CVE-2024-1990HIGHRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-2548MEDIUMRegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password ChangeEPSS 0.7%