CVE-2020-9454: CSRF
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-9454?
CVE-2020-9454 is a CSRF vulnerability in the RegistrationMagic plugin for WordPress that allows remote attackers to forge requests on behalf of a site administrator.
What is the severity of CVE-2020-9454?
CVE-2020-9454 has a severity score of 8.8, which is considered high.
How does CVE-2020-9454 affect the RegistrationMagic plugin?
CVE-2020-9454 allows remote attackers to change all settings for the RegistrationMagic plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads.
How can I fix CVE-2020-9454?
To fix CVE-2020-9454, update the RegistrationMagic plugin to version 4.6.0.4 or later.
Where can I find more information about CVE-2020-9454?
You can find more information about CVE-2020-9454 in the references section: [Reference 1](https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers), [Reference 2](https://wpvulndb.com/vulnerabilities/10116), [Reference 3](https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/).