CVE-2020-9455

The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view.

Score

CVSS 3.1 4.3 Medium

Status

Modified - cve@mitre.org

Published

2020-03-06

Last modified

2024-08-04

Weaknesses

CWE-862

Affected products

• Registrationmagic (Metagauss)

References

• https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers
• https://wpvulndb.com/vulnerabilities/10116
• https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/