CVE-2024-1991: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the updateusersrole() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1991?
CVE-2024-1991 is a high severity vulnerability that allows for privilege escalation due to a missing capability check.
How do I fix CVE-2024-1991?
To fix CVE-2024-1991, update the RegistrationMagic plugin to version 5.3.1.0 or later.
Which versions are affected by CVE-2024-1991?
CVE-2024-1991 affects all versions of the RegistrationMagic plugin up to and including version 5.3.0.0.
Who is responsible for the CVE-2024-1991 vulnerability?
The CVE-2024-1991 vulnerability affects the RegistrationMagic plugin developed by MetaGauss for WordPress.
What type of vulnerability is CVE-2024-1991?
CVE-2024-1991 is classified as a privilege escalation vulnerability.