RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login, dd9693b337972b511204a0a13bacb7cdf2f89de9
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Published on
- Feb 20, 2024
- Research Description
- RegistrationMagic – User Registration Forms Plugin [custom-registration-form-builder-with-submission-manager] < 5.2.6.0 RegistrationMagic <= 5.2.5.9 - Cross-Site Request Forgery The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.5.9. This is due to missing or incorrect nonce validation on the rm_options_default_payment_method() function. This makes it possible for unauthenticated attackers to update the default payment method via a forged request granted they can trick an authenticated site user into performing an action such as clicking on a link.
- Affected versions
-
max 5.2.6.0.
- Status
-
vulnerable