CVE-2020-9458

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

2.51%

Published

Mar 6, 2020

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-862

Affected Products (1)

metagauss · registrationmagicvulnerable

References (6)

https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers

Third Party Advisory

https://wpvulndb.com/vulnerabilities/10116

Third Party Advisory

https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/

ExploitThird Party Advisory

https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers

Third Party Advisory

https://wpvulndb.com/vulnerabilities/10116

Third Party Advisory

https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs