CVE-2024-10508criticalCWE-230

CVE-2024-10508: falha crítica em metagauss RegistrationMagic – Custom…

RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

48Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 9.8epss 1.5%
da publicação à arma10 dias
Publicada no NVD9 de nov.
1ª PoC+10d
The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.2.6. This is due to the plugin not properly validating the password reset token prior to updating a user's password. This makes it possible for unauthenticated attackers to reset the password of arbitrary users, including administrators, and gain access to these accounts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
metagauss · RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — metagauss RegistrationMagic – Custom…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-15403CRITICALRegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_orderEPSS 1.7%CVE-2023-2499CRITICALRegistrationMagic <= 5.2.1.0 - Authentication BypassEPSS 1.3%CVE-2024-1991HIGHRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.9%CVE-2024-1990HIGHRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via ShortcodeEPSS 0.8%CVE-2023-2548MEDIUMRegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password ChangeEPSS 0.7%CVE-2017-20208CRITICALRegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object InjectionEPSS 0.7%