9.8crit
CVE-2017-20208
RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection
Published 12 mo ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 54%
Public exploits
0
none known
Summary
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 12 mo ago
Exploit prediction (EPSS)
0.71% probability of exploitation in the next 30 days, higher than 54% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Classification
- Weakness
- CWE-502 Deserialization of Untrusted Data
References
- wordfence.com /threat-intel/vulnerabilities/id/c2b79193-f8fc-4ea2-8973-fe292cfb926b?source=cve
- wordfence.com /blog/2017/10/3-zero-day-plugin-vulnerabilities-exploited-wild/
- plugins.trac.wordpress.org /changeset/1733274/custom-registration-form-builder-with-submission-manager
Sources
- CVE List: CVE-2017-20208
- NVD: CVE-2017-20208
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.